thunderbird: simple esr bump (Nov 2013), incl. CVE

I failed to make -26 build, so this will get security fixes at least.