ostree: Upgrade 2026.3 -> 2026.4

Upgrade to release 2026.4:

- This release reverts the static delta decompression-size safety
  margin introduced in 2026.3, which turned out to reject legitimate
  large deltas at apply time -- most visibly, Flathub Firefox
  updates were failing with Decompressed delta part exceeds
  configured limit

  Both the margin heuristic and the flat 512 MiB per-part
  decompression cap it fed into have been dropped for now. This
  deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression
  of a given delta part) until a precise, per-part exact-size-based
  replacement lands in a future release. The LZMA decoder memory
  limit (100 MiB) from that same advisory's fix is unaffected and
  remains in place.

- core: fixed a double-increment bug in
  _ostree_validate_structureof_xattrs that caused every other xattr
  entry to be skipped during validation, letting a crafted xattr
  array hide unsorted or duplicate entries in odd-indexed slots.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-extended/ostree/ostree_2026.4.bb

@@ -22,7 +22,7 @@ GITHUB_BASE_URI = "https://github.com/ostreedev/ostree/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libostree-${PV}.tar.xz \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "e560e47631d1f703e9ed3425e8909ccd87fa2992422c07348ca88ec98943c8fb"
+SRC_URI[sha256sum] = "b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7"
 
 S = "${UNPACKDIR}/libostree-${PV}"