Update to pkg 1.5.6
Changes:

• Incorporate in sources the patch for expat CVE-2015-1283 Note that pkg is not vulnerable because it does not use the patched function
• improvements in pkg check manpage
• fix format specifier in libpkg's pkg_vets