[ Reason ]
Fix CVE-2026-16118

[ Impact ]
Fixes something that upstream have treated as a vulnerability (although
I'm unconvinced that it's practically exploitable on systems that aren't
already compromised)

[ Tests ]
autopkgtests pass. Upgraded a trixie GNOME desktop system, it seems to
work normally.

A test-build for amd64 and i386 (differing only in the changelog) is
available at <https://people.debian.org/~smcv/13.7/glib2.0-deb13u5>.

[ Risks ]
I would say low risk, the changes are targeted and obvious.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
      - note that this assumes 2.84.4-3~deb13u4,
https://bugs.debian.org/1143852 was already accepted -
        please see that bug for the deb13u4 changes
  [x] the issue is verified as fixed in unstable

[ Changes ]
d/p/CVE-2026-16118/xdgmime-Check-if-caches-are-set-before-dumping-them.patch
is probably not strictly required, but it was part of the upstream fix
and is obviously harmless (it only touches test/debug code). The other
patch is the actual bug fix.

[ Other info ]
Will need a d-i ack for the graphical installer. Includes the changes
from 2.84.4-3~deb13u4 (https://bugs.debian.org/1143852), which I have
not included in the debdiff here.