CVE-2026-11853: Improper path sanitization in mergeuploads task

The mergechanges task uses debian.deb822.Changes to parse the supplied .changes file. This parser happily accepts paths containing slashes including absolute paths in the Files and Checksums-* sections. When _symlink_files is called, merged_file_path is computed as merged_dir / file["name"] where the latter is unverified input. Therefore, the merged_file_path is fully user controlled (by prepending sufficiently many ../ or using an absolute path). Then, this location is created as a symbolic link unless it already exists. Therefore a malicious user can create possibly arbitrary symbolic links with the permission of the debusine-worker without being able to independently control the symlink target. This poses a minor containment breach.