libtiff: 4.0.9 -> 2018-11-04

This includes a bunch of security fixes (#49786), and mimics what Debian
has done in moving to a git snapshot instead of a released version +
backported security patches.