[ Reason ]
The upstream stable branch received fixes since the latest trixie point
release, and this update pulls them into the debian package. A
significant parts of the changes are security fixes, with 14 CVE fixed.

[ Impact ]
In case the update isn't approved, systems will be left with security
issues, and the differences with upstream will increase.

[ Tests ]
Most of the changes are covered by additional tests, which represent a
significant part of the diff.

[ Risks ]
I believe the risks are low, as the changes do not touch the core part
of the library, and as all the changes are already in testing.

I also did a manual test, upgrading glibc with this version on an amd64
host. It rebooted fine and is still running fine.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
The changes are summarized in the changelog, let me give you a few extra
details for some of them:

  - Cache cpuid results in ld.so for Intel CPUs.

Repeatedly using the cpuid instruction, to select the right
implementation of memory or string functions using the ifunc mechanism,
has a significant performance impact on VMs and on some CPUs like the
Xeon Gold 6430. This adds some simple cache mechanism to reduce the
calls to this instruction.

  - Keep needed last transition to new type in TZif files generated by zic.

This is a tricky one. Canada's provinces decided, one after the other
(and more are likely to follow), not to turn the clocks back this fall.
The new time abbreviation is currently undecided (with each province
wanting to include its name, even if in practice it just matches). Until
a decision is reached and CLDR is updated, starting with tzdata 2026b,
the clock change is temporarily modeled has occuring on 2026-11-01. This
allows the summer timer abbreviation to be kept until that date,
although legally the change to permament -07/-06 is already in effects,
for a few weeks/months depending on the province.

Unfortunately this workaround has revealed a bug in the zic tool, which
mishandles a last transition to a new time type. This backported changes
fixes that. Note that in practice the tzdata package in debian (both
stable and testing/unstable) is not affected, even if it builds the
timezone data with that tool, as it uses the -b fat option for
compatibility with some software (e.g. python-dateutil). However the bug
should still be fixed given some other packages might also use zic, and
given users can also use that tool directly.