CVE-2026-90462: deny access in sdap_access_ppolicy_step_done() when the
LDAP ppolicy user search returns zero entries, instead of returning success
and caching an allow decision
CVE-2026-90996: reject an empty request body in the NSS responder request
parsers before body[blen - 1] is read