SECURITY UPDATE: control-character injection in scheduler option
handling
debian/patches/CVE-2026-34980.patch: filter control characters
from IPP string option values and reject "special" PPD keywords
(cupsFilter, cupsFilter2, etc.) reported back by job filters to
prevent filter/command injection via crafted job options