Aggressively mark more consumers of bundled dcraw as vulnerable

ljpeg_start() originates from dcraw, no need to list every package with
copy of it at the expense of readability.