SECURITY UPDATE: configuration-file injection in the configparser module
when writing multi-line values that contain carriage returns
debian/patches/CVE-2026-0864.patch: normalize CRLF and bare CR to LF
before applying the newline-to-tab continuation escape in
_write_section() in Lib/configparser.py, so an attacker-controlled
value can no longer inject additional keys and sections into the
written file; adds the upstream regression test
test_crlf_normalization to Lib/test/test_configparser.py.