CVE-2026-3494: replace the server_audit plugin's hand-rolled SQL parser
with thd_sql_command(); emit MYSQL_AUDIT_GENERAL_STATUS inside
Prepared_statement::execute; update thd->update_server_status guard in
sp_instr_stmt::execute to include audit-enabled path
CVE-2026-44171: reject unsafe absolute, leading-dot, and parent-traversal
paths during mbstream archive extraction