[ Reason ]
Fix a security issue described on https://www.openwall.com/lists/oss-security/2026/08/17/1
no CVE assigned. Patches cherry picked from upstream repository.
All are triggered by opening/importing/exporting a maliciously crafted LyX
document (network-deliverable: a zip, an email attachment, a shared folder).
Unless noted, the result is arbitrary command execution with the user's
privileges.

[ Impact ]
If the change is not approved the biber program, the user keeps impacted
by the security issue.

[ Tests ]
Upstream provides a test suite, which is not impacted by the change.

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
As described on the URL, the fix consists of the four patches. I've kept
them separated to point to upstream commits.