SECURITY UPDATE: XSS via unsanitized request URI in PHP-FPM status page
debian/patches/CVE-2026-6735.patch: escape request_uri with HTML
entities in fpm_status_handle_request() for HTML/XML output formats,
and fix query_string escape flags in sapi/fpm/fpm/fpm_status.c