www/phpbb3: update to 3.3.17

3.3.14 is affected by CVE-2026-29199 (CVSS 8.1): with force_server_vars
disabled, phpBB builds the password reset link from the HTTP Host
header,
so an attacker who can control that header makes reset mails point to a
domain of their choice, which may lead to account takeover.

Also fixed since 3.3.14: improper state verification in the OAuth
implementation (SECURITY-293), IDOR when composing private messages
(SECURITY-286), CSRF on report submission (SECURITY-287), cross-user
notification read state manipulation (SECURITY-290) and HTML generation
from page data (SECURITY-283).

Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.17/phpBB/docs/CHANGELOG.html
Security: CVE-2026-29199
Security: 4d06b948-a323-11f1-a655-3497f65b111b
MFH: 2026Q3
Sponsored by: Netzkommune GmbH

(cherry picked from commit 501e44be8f095fb8049a92e109af9935d722c948)