fixes CVE-2019-11494 and CVE-2019-11499
https://dovecot.org/pipermail/dovecot-news/2019-April/000408.html

(cherry picked from commit 427dfad)

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/dovecot/versions

(cherry picked from commit 5eb5740)

(cherry picked from commit e217309)

(cherry picked from commit d7582c9)

…them all

Fixes:

* CVE-2019-6472 affects the Kea DHCPv6 server, which can exit
  with an assertion failure if the DHCPv6 server process receives
  a request containing DUID value which is too large.
  (https://kb.isc.org/docs/cve-2019-6474)

* CVE-2019-6473 affects the Kea DHCPv4 server, which can exit with
  an assertion failure if it receives a packed containing a malformed
  option.  (https://kb.isc.org/docs/cve-2019-6473)

* CVE-2019-6474 can cause a condition where the server cannot be
  restarted without manual operator intervention to correct a problem
  that can be deliberately introduced into the stored leases.
  CVE-2019-6474 can only affect servers which are using memfile
  for lease storage.  (https://kb.isc.org/docs/cve-2019-6474)

Annoucement: https://www.openwall.com/lists/oss-security/2019/08/29/1
(cherry picked from commit e6e3270)

https://dovecot.org/pipermail/dovecot-news/2019-April/000411.html
(cherry picked from commit c38b485)

(cherry picked from commit 4f38967)

This is a followup on #67623

(cherry picked from commit 46ff96c)

…es them all

[19.03] dovecot: 2.3.5.7 -> 2.3.7.2, pigeonhole: 0.5.5 -> 0.5.7.2

(cherry picked from commit c323b0e)

[19.03] kea: 1.5.0 -> 1.5.0-P1 (security)