https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6

See related #3437 and #3438

I'm not making any kind of statement or promises about whether I'll cut
security releases for v1.17.x in the future. I'm doing this because
Mastodon 4.2 still supports Ruby 3.0 and its dependency on ruby-saml
makes it potentially impacted by the underlying libxml2 fixes.

I know somebody out there, somewhere, is going to say "I'll stay on Ruby
3.0 if Mike is going to keep cutting security updates", and hoo boy that
is NOT a bet you should be making. I am the most enthusiastic supporter
of "dropping support for EOL versions of Ruby" that you will ever meet,
and this is NOT going to continue.

I know somebody out there, somewhere, is going to try to convince me
that because I made this one security update, I'm somehow _obligated_ to
continue supporting the v1.17.x branch. If you feel the urge to send me
a message like that, please restrain yourself and do not make me regret
doing this thing.