SECURITY UPDATE: insufficient entropy in pyexpat/_elementtree hash-flooding
protection (CVE-2026-7210)
debian/patches/CVE-2026-7210.patch: bind XML_SetHashSalt16Bytes as a weak
symbol to seed the parser with 16 bytes of entropy when hash randomization
is enabled; falls back to the legacy XML_SetHashSalt when unavailable.