SECURITY UPDATE: NULL pointer dereference in mod_heartmonitor
debian/patches/CVE-2026-46729.patch: reject a heartbeat POST body
that lacks the busy or ready parameter with HTTP 400 instead of
passing a NULL pointer to atoi() in hm_handler() in
modules/cluster/mod_heartmonitor.c.