mpv: fix CVE-2018-6460

Upstream has fixed this in a series of commits ontop of 0.28.0. Debian
has backported the fixes to 0.27.0.

Upstream issue: https://github.com/mpv-player/mpv/issues/5456
Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888654#8