- set the license to Apache 2.0 only, one have to download another
   tarball for the GPL version (2.12 was using Apache 2.0 tarball);
 - use the download link from the main web site for easier checksum
   cross-verification (github tarballs have different SHA sums);
 - sort secfixes from newer-to-older;
 - add python3 as now required for build.

Rebuild is needed for the dependent aports due to libmbedtls.so.12
version bump (was .11).