Please accept upload of lomiri-download-manager 0.2.1-3+deb13u1 to trixie.

[ Reason ]
Security fixes, preventing arbitrary filesystem access as root:

  CVE-2026-96424: Fix incorrect DBus policy for lomiri-upload-manager
  (part of lomiri-download-manager) that allows arbitrary user to read
  arbitrary file as root over DBus Source.
  CVE-2026-96425: Fix incorrect DBus policy for lomiri-download-manager
  that allows arbitrary user to run arbitrary command as root over DBus.

[ Impact ]
Security issues will not get fixed.

[ Tests ]
Manual tests in Lomiri on Debian 13.

[ Risks ]
Only for Lomiri users.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

+  * debian/patches:
+    + Add 0001_src-downloads-dont-run-commands-when-privileged.patch and
+      0002_src-uploads-downloads-daemon-conf-deny-access-to-system.patch.
+      CVE-2026-96424: Fix incorrect DBus policy for lomiri-upload-manager
+      (part of lomiri-download-manager) that allows arbitrary user to read
+      arbitrary file as root over DBus Source.
+      CVE-2026-96425: Fix incorrect DBus policy for lomiri-download-manager
+      that allows arbitrary user to run arbitrary command as root over DBus.
+  * debian/control:
+    + Add to B-D: libcap-dev.

[ Other info ]
Security team requested to upload this via trixie-pu.