thunderbird: simple esr bump (Nov 2013), incl. CVE

I failed to make -26 build, so this will get security fixes at least.

(cherry picked from commit 3269027235e562ecb73264b708af48a79149b891)
libyaml: minor update 0.1.3 -> .5

The CVE patches are in the release now.

(cherry picked from commit 334a911ace888ae82d0c34b99c237f6f0632ff8d)

Conflicts:
	pkgs/development/libraries/libyaml/default.nix