Comment 12 for bug 1684320

Okay, so somewhere between the aforementioned B2 ("A vulnerability without a complete fix yet...") and B1 ("A vulnerability that can only be fixed in master, security note for stable branches, e.g., default config value is insecure"). I'll go ahead and mark our advisory task "won't fix" and let the OSSN editors decide how and when they might want to write this up as a note.