Add a missing release notes for CVE-2013-4795, fixed in 1.6.18.

This was a XSS vulnerability that was fixed as part of Djblets.