debian/patches/CVE-2022-38023.patch: change "reject md5 clients" and
"reject md5 servers" defaults to yes, deprecate "allow nt4 crypto" and
"reject md5 clients", add "server schannel require seal" (default yes)
and require DCERPC_AUTH_LEVEL_PRIVACY in the source3 and source4
netlogon servers including all netr_LogonSamLogon* variants, defer the
ServerAuthenticate3 downgrade check until the account is found in the
SAM so that "server reject md5 schannel:COMPUTERACCOUNT" and
"allow nt4 crypto:COMPUTERACCOUNT" exceptions apply