Backport upstream patch for CVE-2025-64076

Source: Fedora 42 python-cbor2 Critical Integer Underflow DoS 2026-0afc953516