CLSA-2026-1792072825 Fix CVE(s): CVE-2026-106568, CVE-2026-109263, CVE-2026-109275

SECURITY UPDATE: infinite loop on circular parameter entities - debian/patches/CVE-2026-106568.patch: check entity values for both '%' and '&' references in ValidateEntities so circular parameter entity declarations are rejected in ParseInternalDoctype in magick/xml-tree.c - CVE-2026-106568...