CVE-2026-15588: limit the length of lines GDBusServer reads from an
unauthenticated client, preventing unbounded memory and CPU consumption
add upstream prerequisite 3272.patch (gdbus: never buffer reads during
server authentication), which routes all three server authentication
states through the byte-at-a-time reader the CVE fix bounds