SECURITY UPDATE: pre-authentication denial of service via GSSAPI
debian/patches/CVE-2026-60000.patch: discard GSSAPI error tokens in
auth2-gss.c instead of feeding them into the GSSAPI stack, and count
the failed attempt so GSSAPI auth is subject to MaxAuthTries