control code in cookie denial of service (CVE-2022-35252)

fix unpreserved file permissions (CVE-2022-32207)
fix HTTP compression denial of service (CVE-2022-32206)
fix FTP-KRB bad message verification (CVE-2022-32208)

fix too eager reuse of TLS and SSH connections (CVE-2022-27782)

fix leak of SRP credentials in redirects (CVE-2022-27774)

add missing tests to Makefile

fix credential leak on redirect (CVE-2022-27774)
fix auth/cookie leak on redirect (CVE-2022-27776)
fix bad local IPv6 connection reuse (CVE-2022-27775)
fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)

re-disable HSTS in libcurl as an experimental feature (#2005874)

disable more protocols and features in libcurl-minimal (#2005874)

fix STARTTLS protocol injection via MITM (CVE-2021-22947)
fix protocol downgrade required TLS bypass (CVE-2021-22946)
fix use-after-free and double-free in MQTT sending (CVE-2021-22945)

Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

Rebuild to pick up OpenSSL 3.0 Beta ABI (#1984097)

make explicit dependency on openssl work with alpha/beta builds of openssl

fix TELNET stack contents disclosure again (CVE-2021-22925)
fix bad connection reuse due to flawed path name checks (CVE-2021-22924)

Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065

build the curl tool without metalink support (#1967213)

fix SIGSEGV upon disconnect of a ldaps:// transfer (#1941925)