SUSE-SU-2026:4954-1: Security update for curl

This update for curl fixes the following issues:

- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414). - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426). - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477). - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478). - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482). - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173). - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031). - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030). - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026). - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023). - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022). - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021). - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018). - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017). - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016). - CVE-2026-92389: TFTP direction confusion (bsc#1285015). - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014). - CVE-2026-92391: curlmimefree stack overflow by recursion (bsc#1285013). - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012). - CVE-2026-94266: password leak in CURLINFOEFFECTIVEURL (bsc#1285010). - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).