SECURITY UPDATE: NULL pointer dereference in krb5_rd_cred()
debian/patches/CVE-2026-107778.patch: reject a KRB-CRED message whose
encrypted ticket-info list is shorter than its tickets list in
src/lib/krb5/krb/rd_cred.c make_cred_list(); backport of upstream
commit 48afa9abb89ab2176bb20624d87d010b9984fc08