[ Reason ]
Neovim versions >= 0.9 added a vim.secure module to manage trust when
automatically sourcing files from a directory. The vim.secure.read()
API, used to read those files, was subject to command injection
(CVE-2026-11487).

This upload backports the patch to fix the CVE, with adjustments to make
the test work in trixie's neovim version (thanks to Agatha Porte).

[ Impact ]
No-DSA CVE remains unfixed.

[ Tests ]
Upstream added an automated test to validate the fix. I've validated it
fails before the fix.

[ Risks ]
Scope is limited to this API and has a test, so it is pretty targeted.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
* Backport of CVE fix
* Package metadata adjustments for first trixie upload (ci release, gbp
  config)