CLSA-2026-1792505524 Fix of 6 CVEs

SECURITY UPDATE: heap buffer underwrite in the PICT decoder - debian/patches/CVE-2026-109964.patch: stop decoding when the row pointer wraps below the pixel buffer in DecodeImage in coders/pict.c - CVE-2026-109964 SECURITY UPDATE: MVG command injection via the SVG decoder -...