* SECURITY UPDATE: Use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, resolve the SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to that context and to the callback while they are in use, and unregister the callback in context_dealloc(), so a client can no longer make the server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream ec44b5a3258c (gh-156293, GH-158504); Py_NewRef() and Py_XNewRef() become Py_INCREF() and Py_XINCREF(), which is what 3.9 provides, and the context_dealloc() unregister is wrapped in this branch's HAVE_SNI guard. Includes the upstream regression tests, which apply unchanged - CVE-2026-19445