CVE-2026-53587: bounds-check the capability buffer before the fixed-size
object-format= comparison in set_data, so a short pkt-line cannot cause a
heap out-of-bounds read (vendored libgit2 1.8.1; the vendored libgit2 1.3.0
copy has no object-format parsing and is unaffected)