haskell-xmonad-contrib: update to version 0.11.3, fix CVE-2013-1436

The problem was for users of DynamicLog with status bars
like xmobar/dzen2, and allowed *websites* to inject commands into them.

(cherry picked from commit f9f19ee938117b9421bab65b277f3353ee549a60)