Backport the fix for CVE-2026-2447 to seamonkey

[Douglas R. Reno]

Both Thunderbird and Firefox got emergency updates for a high severity heap buffer overflow problem in libvpx. We use the system copy for both of those packages, so we in theory shouldn't be affected by those unless a user didn't install the recommended dependencies (which is certainly possible and part of why we should be doing those anyway)

On the other hand, Seamonkey does use the bundled copy of libvpx, so it's directly impacted by this issue. It looks like a remote code execution rated as 8.8 High, and can be triggered via video playback. Note though that some sites use autoplay and a user can thus get hit by this vulnerability through normal browsing activities.

[zeckma]

Fixed at c8199480b8776e50e82ef738bbb8d94973df4e0a. Leaving open for SA.

[zeckma]

Addressed in SA-12.4-100.