SECURITY UPDATE: quadratic-complexity denial of service in HTMLParser
incremental parsing
debian/patches/CVE-2026-15308.patch: accumulate feed() data in a list
in Lib/HTMLParser.py so an unterminated markup construct fed across
many feed() calls is no longer rescanned and reconcatenated on every
call; adds a regression test in Lib/test/test_htmlparser.py.