Backport upstream commit 25db861d to fix CVE-2026-39373.
This introduces a maximum plaintext size limit (defaulting to 100MB)
during JWE decryption to mitigate memory exhaustion and decompression
bomb attacks when processing highly compressed malicious JWE payloads.
Resolves: RHEL-166011
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
