ostree: upgrade 2026.4 -> 2026.5

This release is mostly hardening against untrusted repository content.
It fixes two checkout issues: a crafted whiteout name that strips to
".." and makes a --whiteouts checkout delete the destination's parent
(GHSA-cp2j-qv7x-wcw4), and union checkouts following a symlink planted
at a directory name and writing outside the destination
(GHSA-7pq7-3pmj-9wp6). Composefs and commit signature checks with the
OpenSSL ed25519/SPKI backends now accept only EVP_DigestVerify() == 1,
where error returns used to count as a valid signature. Static delta,
content header, commit and curl header parsing gain bounds checks.

Behaviour changes: the default min-free-space is now min(3%, 1GB), and
the systemd generator leaves boot.mount to systemd-fstab-generator when
/etc/fstab has a /boot entry.

https://github.com/ostreedev/ostree/releases/tag/v2026.5

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-extended/ostree/ostree_2026.5.bb

@@ -22,7 +22,7 @@ GITHUB_BASE_URI = "https://github.com/ostreedev/ostree/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libostree-${PV}.tar.xz \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7"
+SRC_URI[sha256sum] = "1829428ed2d982dc684211ff18525b57ea627056a68fa5b04f674f0ca6c9c19b"
 
 S = "${UNPACKDIR}/libostree-${PV}"