python3-autobahn: Upgrade 26.10.2 -> 26.11.1

Upgrade to release 26.11.1:

- Security: parse the HTTP headers of the WebSocket opening
  handshake strictly (RFC 9112, RFC 9110). The header block was
  split with str.splitlines(), which also splits on VT, FF, FS, GS,
  RS, NEL and on a bare CR or LF, so a peer could make autobahn see
  header lines that a front proxy treats as part of a header value,
  for example an X-Forwarded-For used with trustXForwardedFor.
  Lines are now separated by CRLF only. ⚠ behaviour change — a
  header block with a bare CR or LF, obs-fold, whitespace before
  the colon, an invalid header name, a header line without a colon
  (was skipped), or a control character in a header value or the
  status line is rejected: the server fails the handshake with HTTP
  400, the client fails the handshake or the proxy CONNECT. A bare
  LF is rejected deliberately, although RFC 9112 allows accepting
  it as a line end. obs-text (0x80-0xFF) in header values is still
  allowed, and header values are trimmed of SP and HTAB only. This
  fixes advisory GHSA-2gqc-mwv3-66rp

- Security: raise the floors of the compress extra (and so all)
  to brotli>=1.2.1 (CPython) and brotlicffi>=1.2.1.0 (PyPy), the
  releases with the fix for CVE-2026-111497, an out-of-bounds write
  in the brotli decoder that permits remote code execution.
  permessage-brotli decodes data sent by the WebSocket peer; it is
  not used unless an application offers or accepts it. The brotli
  1.0.10 and 1.1.1 backports of the fix are not enough, since the
  permessage-brotli receive path needs the decompression limit of
  brotli 1.2. New tests check the declared floors and the installed
  version

- Add tests for the HTTP header parsing of the WebSocket opening
  handshake, on the server, the client and the explicit proxy
  CONNECT, run on Twisted and asyncio

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch

@@ -1,4 +1,4 @@
-From bfcf66157dab06a8f4f718cc0016e799f6b9e284 Mon Sep 17 00:00:00 2001
+From 77c79aa0e048e4bea40eb794a623c36ff1ec3fbc Mon Sep 17 00:00:00 2001
 From: Leon Anavi <leon.anavi@konsulko.com>
 Date: Mon, 20 Jul 2026 15:52:32 +0300
 Subject: [PATCH] Skip -march guessing for external cross toolchains

meta-python/recipes-devtools/python/python3-autobahn_26.11.1.bb

@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=49165a577911c4178e915dc26e2802a3"
 
 SRC_URI += "file://0001-Skip-march-guessing-for-external-cross-toolchains.patch"
 
-SRC_URI[sha256sum] = "6c69fca89106567060941c5568e67a5369738813d883db4e3d62b76f0a2c497e"
+SRC_URI[sha256sum] = "1a081ca27ad5a0a04d3c7ca07b2caa6d324b8004383e36ae6eede1d5053e23b0"
 
 CVE_PRODUCT = "autobahn"