CLSA-2026-1777591889 Fix CVE(s): CVE-2026-35414

SECURITY UPDATE: incorrect matching of authorizedkeys principals="..." option when a certificate principal name contains a comma character - debian/patches/CVE-2026-35414.patch: split principallist on commas and exact-match each entry instead of passing it to matchlist - CVE-2026-35414...