OESA-2026-3217 python-lxml security update

\ Security Fixes: lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:href. The vulnerability exists because Cleaner filters URL schemes by walking links via rewritelinks, which delegates to iterlinks, which only yields attributes named in...