[ Reason ]
Fixes for CVE-2026-52747 and CVE-2026-52761

[ Impact ]
Security rules bypass.

[ Tests ]
Fixed and tested by upstream.

[ Risks ]
Low risk, simple patch.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Preserve line breaks from non-file form-field values.
Fix returned length of "unicode" variable.