SECURITY UPDATE: NULL pointer dereference in mod_heartmonitor
debian/patches/CVE-2026-46729.patch: reject heartbeat POSTs that
lack the busy or ready parameter or exceed the maximum message
length, and parse port, busy and ready with strtol() validation in
hm_handler() in modules/cluster/mod_heartmonitor.c.