SECURITY UPDATE: CPU denial of service via quadratic complexity in
HTMLParser incremental parsing
debian/patches/CVE-2026-15308.patch: accumulate feed() data in a list and
defer joining and rescanning the buffer until enough has piled up in
Lib/HTMLParser.py, avoiding quadratic behaviour on repeated unterminated
markup declarations; add regression test to Lib/test/test_htmlparser.py