Import upstream patches to fix 3 CVEs

Backport part of the DLA-4625-1 fix set to stretch 2.76. Only three of the five CVEs affect this release:

• CVE-2026-2291: buffer overflow in struct bigname
• CVE-2026-4892: buffer overflow in helper.c with large CLIDs
• CVE-2026-4893: broken client subnet validation

CVE-2026-4890 and CVE-2026-4891 are not applicable: they live in src/dnssec.c, and DNSSEC support was removed in 2.76-5+deb9u5 (built with the nodnssec option), so that code is not compiled in.

The 2291 and 4892 patches apply to 2.76 with only line offsets. The 4893 patch was regenerated with 2.76 context: the upstream one-liner does not apply as-is, but the fix is identical -- pass the packet length (the size_t parameter n, unmodified before the call) rather than the OPT record length to check_source().

Debusine workflow: https://debusine.freexian.com/freexian/elts-staging/work-request/254483/

Note: CVE-2026-5172 is a 6th dnsmasq CVE from the same 2026-05-11 batch, which is not fixed by DLA-4625-1. 2.80's extract_addresses() lacks the vulnerable generic-RR/rrblock path, so 2.80 is not affected.

Note: CVE-2026-4890 and CVE-2026-4891 are not-affected: they live in src/dnssec.c, and DNSSEC support was removed in 2.76-5+deb9u5 (built with the nodnssec option), so that code is not compiled in.