bpo-35907: Fix typo in the NEWS entry (GH-13559)

Author: vstinner

Misc/NEWS.d/next/Security/2019-05-21-23-20-18.bpo-35907.NC_zNK.rst

@@ -1,3 +1,3 @@
 CVE-2019-9948: Avoid file reading by disallowing ``local-file://`` and
-``local_file://`` URL schemes in ``URLopener().open()``
+``local_file://`` URL schemes in ``URLopener().open()`` and
 ``URLopener().retrieve()`` of :mod:`urllib.request`.