CLSA-2026-1786033457 Fix CVE(s): CVE-2026-56131

SECURITY UPDATE: use-after-free via re-entrant parser API calls made from inside handler callbacks - debian/patches/CVE-2026-56131.patch: track handler call depth and refuse XMLResumeParser, XMLParse, XMLParseBuffer, XMLGetBuffer, XMLParserFree and XMLParserReset while a handler is on the stack...