[ Reason ]
Fixes for CVE-2026-86320 and GHSA-484h-v688-jq5j

[ Impact ]
Code execution and file access on the host when building flatpaks.

[ Tests ]
The fix for GHSA-484h-v688-jq5j has a unit test that is run as part of
the autopkgtest.
CVE-2026-86320 has a PoC that I've manually verified.

[ Risks ]
The largest change has good test coverage. The rest are relatively simple fixes.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Backport of the upstream security fixes.