gnu: icecat: Update bundled graphite2 to 1.3.5 for security fixes.

* gnu/packages/patches/icecat-update-graphite2.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patch.  Add TODO
  comment about using the system graphite2 in the future.

gnu-system.am

@@ -521,6 +521,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/hydra-automake-1.15.patch		\
   gnu/packages/patches/hydra-disable-darcs-test.patch		\
   gnu/packages/patches/icecat-avoid-bundled-includes.patch	\
+  gnu/packages/patches/icecat-update-graphite2.patch		\
   gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch	\
   gnu/packages/patches/icu4c-CVE-2014-6585.patch		\
   gnu/packages/patches/icu4c-CVE-2015-1270.patch		\

gnu/packages/gnuzilla.scm

@@ -289,7 +289,8 @@ standards.")
         "0bd4k5cwr8ynscaxffvj2x3kgky3dmjq0qhpcb931l98bh0103lx"))
       (patches (map search-patch
                     '("icecat-avoid-bundled-includes.patch"
-                      "icecat-re-enable-DHE-cipher-suites.patch")))
+                      "icecat-re-enable-DHE-cipher-suites.patch"
+                      "icecat-update-graphite2.patch")))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -318,6 +319,8 @@ standards.")
                       ;; TODO: Use system harfbuzz.  Waiting for:
                       ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=847568>
                       ;;
+                      ;; TODO: Use system graphite2.
+                      ;;
                       "modules/freetype2"
                       "modules/zlib"
                       "modules/libbz2"