prosody - security update

The flaw allows a malicious server to impersonate the vulnerable domain
to any XMPP domain whose domain name includes the attacker’s domain as a
suffix.

For example, bber.example would be able to connect to jabber.example
and successfully impersonate any vulnerable server on the network.

This release also fixes a regression introduced in the previous
CVE-2016-1232 fix: s2s doesn’t work if /dev/urandom is read-only.