* SECURITY UPDATE: urllib handed out HTTPS credentials for plain-HTTP URLs - debian/patches/CVE-2026-15806.patch: scope HTTPPasswordMgr credentials by URL scheme. reduce_uri() drops the scheme, so credentials registered for "https://host/" were also returned for "http://host/", and an attacker able to force an HTTPS to HTTP downgrade or redirect received them in cleartext. Adds _reduce_uri_with_scheme() and _is_suburi_with_scheme() and uses them in HTTPPasswordMgr and HTTPPasswordMgrWithPriorAuth. A URI registered without a scheme still matches any scheme, so proxy authentication is unchanged. Carries upstream's regression tests (gh-155694) - CVE-2026-15806 * SECURITY UPDATE: stringprep case-folded characters that Unicode 3.2.0 leaves alone - debian/patches/CVE-2026-17084.patch: map_table_b3() fell back to str.lower(), which uses the interpreter's own Unicode 13.0.0 data instead of the Unicode 3.2.0 data RFC 3454 mandates, so the idna codec folded e.g. Cherokee, Georgian Mtavruli and Cyrillic Palochka and could derive a different A-label for the same domain name. Regenerates Lib/stringprep.py so b3_exceptions pins every such codepoint to itself, and updates Tools/unicode/mkstringprep.py accordingly. The table was regenerated with this version's own interpreter (UCD 13.0.0), because the upstream table is specific to the Unicode version it was built with. Carries upstream's idna regression test (gh-155292) - CVE-2026-17084