CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection

When `CURLOPT_CRLF` is enabled, `imap_perform_append()` advertises the **original** input file size in the IMAP `APPEND ... {N}` literal but then transmits the **expanded** body (bare LF → CRLF). The server consumes exactly N bytes as the literal, and the overflow bytes are parsed as new IMAP …

result = Curl_creader_set_fread(data, data->state.infilesize);
...
result = imap_sendf(data, imapc, "APPEND %s%s {%" FMT_OFF_T "}",
                    mailbox, curlx_dyn_ptr(&flags), data->state.infilesize);