gd: apply patch for CVE-2016-3074 from upstream

Source:
2bb97f407c.patch

The original patch contains binary data, however, which is not supported
by `patch`; we could use `git apply` here, of course, but it was simpler
to just copy-paste only the fix into a separate file and include it in
the repo.

pkgs/development/libraries/gd/default.nix

@@ -12,12 +12,16 @@
 stdenv.mkDerivation rec {
   name = "gd-${version}";
   version = "2.1.1";
-  
+
   src = fetchurl {
     url = "https://github.com/libgd/libgd/releases/download/${name}/libgd-${version}.tar.xz";
     sha256 = "11djy9flzxczphigqgp7fbbblbq35gqwwhn9xfcckawlapa1xnls";
   };
 
+  patches = [
+    ./CVE-2016-3074.patch
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ zlib fontconfig freetype libjpeg libpng libtiff libXpm ];