SECURITY UPDATE: use-after-free in the ssl servername (SNI) callback
(CVE-2026-19445)
debian/patches/CVE-2026-19445.patch: look the SSLContext up from
the SSL object instead of the borrowed pointer registered with
OpenSSL, hold references to it and to the callback while it runs,
and unregister the callback when the SSLContext is deallocated in
Modules/_ssl.c, so that a later ClientHello can no longer reach a
released SSLContext; add a regression test to Lib/test/test_ssl.py
and a note to Doc/library/ssl.rst