SECURITY UPDATE: remote command execution via unescaped %u in the
"check password script" (samr password validation)
debian/patches/CVE-2026-4408.patch: reject invalid/dangerous account
names, mask and single-quote the username before %u substitution,
export SAMBA_CPS_ACCOUNT_NAME, and restrict _samr_ValidatePassword to DCs