Security update of sssd in Debian trixie.

[ Reason ]
This upload fixes various vulnerabilities of sssd in Debian trixie:

  * CVE-2025-11561
  * CVE-2026-6245
  * CVE-2026-12610
  * CVE-2026-14474
  * CVE-2026-14476
  * CVE-2026-68742
  * CVE-2026-68743
  * CVE-2026-68744

Undocumented in d/changelog (unfortunately), it adds a patch that make
unit tests succeed on systems where ntp(sec) daemon is installed and running:

  * test_pam_srv-Use-more-random-UIDs-GIDs-for-the-test.diff

Let me know if you prefer a re-upload of 2.10.1-2+deb13u1 that mentions
the above named patch in d/changelog.

[ Impact ]
sssd in trixie stays vulnerable.

[ Tests ]
Unit tests. Smoke test on a Debian Edu roaming workstation.

[ Risks ]
For sssd users / on sites using sssd regressions may occur.

[ Checklist ]
  [x] *(nearly) all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

```
diff -Nru sssd-2.10.1/debian/changelog sssd-2.10.1/debian/changelog
--- sssd-2.10.1/debian/changelog	2025-01-14 07:45:10.000000000 +0100
+++ sssd-2.10.1/debian/changelog	2026-09-08 05:21:12.000000000 +0200
@@ -1,3 +1,24 @@
+sssd (2.10.1-2+deb13u1) trixie; urgency=medium
+
+  * debian/patches:
+    + Add CVE-2026-12610.diff. (Closes: #1141323).
+      CVE-2026-12610: PAM: fix use-after-free during p11_child processing.
+    + Add CVE-2025-11561.diff. (Closes: #1117935).
+      CVE-2025-11561: krb5: disable Kerberos localauth an2ln plugin for AD/IPA.
+    + Add CVE-2026-6245.diff. (Closes: #1134269).
+      CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data.
+    + Add CVE-2026-14474.diff and CVE-2026-14476.diff. (Closes: #1141769).
+      CVE-2026-14474: sudo: warn when ldap_sudo_search_base falls back to root DN.
+      CVE-2026-14476: gpo: reject path traversal in gPCFileSysPath.
+  * debian/patches:
+    + Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-2026-68744.diff
+      (Closes: #1143600, #1143947).
+      CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr().
+      CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1().
+      CVE-2026-68744: NSS: fix initgroups packet heap disclosure.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Tue, 08 Sep 2026 05:21:12 +0200
+
 sssd (2.10.1-2) unstable; urgency=medium

   [ Timo Aaltonen ]
```

[ Other info ]
None.