Oops, mark bundled libvpx v1.4.0 in firefox as vulnerable again

libvpx v1.3.0-4418-g587ff64 in firefox-esr 38.x shouldn't be affected
given Mozilla hasn't backported the update there. MFSA 2015-89 says
otherwise though.

https://bugzilla.mozilla.org/show_bug.cgi?id=1178215