SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding
protection (CVE-2026-7210)
debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak
symbol to seed the parser with 16 bytes of entropy; falls back to the
legacy 8-byte XML_SetHashSalt when libexpat lacks the symbol.