CLSA-2026-1792537548 Fix CVE(s): CVE-2025-7425

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...