CVE-2026-92387: never-ending loop via server response omission

I found a way to make a malicious FTP, IMAP, POP3, or SMTP server defeat libcurl's own transfer timeout entirely and, worse, freeze every *other* transfer sharing the same multi handle. All it takes is never sending a final control-response line.

// lib/pingpong.c:70-75
if(!pp->response_time)
  pp->response_time = ...;
...