firefox-esr-60: mark as vulnerable

The last release was in September, so it's surely "vulnerable" now.
https://www.mozilla.org/en-US/firefox/60.9.0/releasenotes/

This is the same appproach we've taken for esr-52.

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -89,6 +89,7 @@ rec {
 
     meta = firefox.meta // {
       description = "A web browser built from Firefox Extended Support Release source tree";
+      knownVulnerabilities = [ "Support ended around October 2019." ];
     };
     updateScript = callPackage ./update.nix {
       attrPath = "firefox-esr-60-unwrapped";