SECURITY UPDATE: incorrect regular expression match when the Aho-Corasick
prescan resumes after following a fail link
debian/patches/CVE-2026-19487.patch: reset the "failed" flag on a
successful trie transition in S_find_byclass() in regexec.c, and add the
upstream regression tests to t/re/re_tests