SECURITY UPDATE: command injection in tar plugin Vimuntar()
debian/patches/CVE-2026-46483.patch: pass shellescape(tartail, 1)
instead of shellescape(tartail) in the two :!gunzip / :!gzip -d
lines of runtime/autoload/tar.vim::tar#Vimuntar() so Vim's
special characters (!, %, #) are escaped before the filename
reaches the shell; matches upstream patch 9.2.0479