SUSE-SU-2026:5127-1: Security update for flatpak

This update for flatpak fixes the following issues:

- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769). - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770). - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236). - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515). - CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516). - CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519). - CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523). - CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

- Update to version 1.16.6 (jsc#PED-17048): + Fix file descriptor leaks affecting Chromium-based browsers. + Fix installing extra-data without a runtime, including OpenH264. + Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions. + Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments. - Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths. - Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies. - Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.