SECURITY UPDATE: denial of service via repeated IPP group tags
debian/patches/CVE-2026-107890.patch: drop unnamed group separator
attributes from job creation requests in scheduler/ipp.c add_job()
and add_job_subscriptions() so cupsd does not dereference a NULL
attribute name when starting the job; based on upstream commit
f3fb41912e4e29dbbbe7c4afd4fe48508af21bc0