SECURITY UPDATE: configuration file injection via carriage returns in
multi-line ConfigParser values (CVE-2026-0864)
debian/patches/CVE-2026-0864.patch: normalize CR and CRLF to LF plus tab
continuation at both value-serialisation sites in
RawConfigParser.write() in Lib/ConfigParser.py, so a carriage return
inside an attacker-controlled value can no longer inject extra keys and
sections into the written file; adds the upstream regression test to
Lib/test/test_cfgparser.py.