[ Reason ]
Fix CVE-2026-55995 (bug #1143053). It is a pre-auth DoS.

[ Impact ]
The DoS stays unfixed.

[ Tests ]
There are autopkgtests. I cannot verify the bug as no reproducer is
publicly available.

[ Risks ]
The diff seems small and nothing is obviously wrong with it.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

Picks two upstream patches:
1) to fix the CVE
2) to fix an issue that showed up in autopkgtests, which was fixed only
for forky. The issue is due to gcc changes, and IIRC autopkgtests for
the version that forky inherited from trixie failed. Including it to
avoid future surprises.

[ Other info ]
Nothing I'm aware of.

Best,
Chris