CVE-2026-92386: server-set cookie aborts cookie jar load

I found a way for a remote server to poison a shared cookie jar so that later, unrelated transfers fail before any network I/O happens. It just has to send a Set-Cookie that curl happily accepts but can never read back from its own jar file.

// lib/cookie.c:1184-1186
struct dynbuf buf;
Curl_dyn_init(&buf, MAX_COOKIE_LINE);
while(Curl_get_line(&buf, fp)) {