CVE-2026-49337: free orphaned slice header when no active image unit

CVE-2026-49337: free orphaned slice header when no active image unit

Origin: upstream, https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm
Bug-Debian: https://bugs.debian.org/1140431
Applied-Upstream: 1.1.0
Comment: Backport: on 1.0.15 the pre-existing unconditional add_slice_segment_header() call must be removed (upstream moves it into the guarded block); keeping both would double-free every slice header.

Slice headers attached to finished pictures without an active image unit
were retained forever; a crafted NAL sequence can grow memory without
bound during continuous streaming.

Gbp-Pq: Name CVE-2026-49337.patch