CVE-2026-6100: fix a use-after-free in the bz2 and zlib modules when a
decompressor object is reused after a MemoryError; the input pointer to
the released caller buffer is no longer kept, so a later
decompressobj().flush() (as done by gzip.GzipFile at EOF) cannot read it