neon: bump version

Closes #4321

Old neon version wasn't compatible with our openssl version, so bump
the version. This also fixes some security related bugs.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>