update to latest upstream (BZ 1536755)
    add upstream patch for CVE-2017-17528 (and one follow-up patch, BZ 1528426,
      BZ 1528425)
    turn off virtual keyboard (the keyboard pack files are not installed
      and scummvm doesn't have a global search path for them on platform sdl/posix)