[CVE-2026-3479] Fix pkgutil.get_data() documentation

The documentation still claimed that get_data() can follow parent
directories and absolute paths, which contradicts the validation added
for CVE-2026-3479.  Also register the `cve` Sphinx role used by the
NEWS entry for this CVE.

Fixes: bsc#1259989 (CVE-2026-3479)
Patch: CVE-2026-3479-pkgutil_get_data-docs.patch

Author: mcepl

Doc/library/pkgutil.rst

@@ -226,9 +226,10 @@ support.
       d = os.path.dirname(sys.modules[package].__file__)
       data = open(os.path.join(d, resource), 'rb').read()
 
-   Like the :func:`open` function, :func:`!get_data` can follow parent
-   directories (``../``) and absolute paths (starting with ``/`` or ``C:/``,
-   for example).
+   The *resource* argument must be a relative path that stays within the
+   package directory.  Absolute paths (starting with ``/`` or ``C:/``,
+   for example) and paths containing a parent directory component
+   (``..``) raise :exc:`ValueError`.
 
    .. warning::
 

Doc/tools/extensions/pyspecific.py

@@ -42,6 +42,7 @@
 ISSUE_URI = 'https://bugs.python.org/issue%s'
 GH_ISSUE_URI = 'https://github.com/python/cpython/issues/%s'
 SOURCE_URI = 'https://github.com/python/cpython/tree/3.6/%s'
+CVE_URI = 'https://www.cve.org/CVERecord?id=CVE-%s'
 
 # monkey-patch reST parser to disable alphabetic and roman enumerated lists
 from docutils.parsers.rst.states import Body
@@ -100,6 +101,15 @@ def gh_issue_role(typ, rawtext, text, lineno, inliner, options={}, content=[]):
     return [refnode], []
 
 
+# Support for linking to CVE records in backported NEWS entries.
+
+def cve_role(typ, rawtext, text, lineno, inliner, options={}, content=[]):
+    cve = utils.unescape(text)
+    text = 'CVE-' + cve
+    refnode = nodes.reference(text, text, refuri=CVE_URI % cve)
+    return [refnode], []
+
+
 # Support for linking to Python source files easily
 
 def source_role(typ, rawtext, text, lineno, inliner, options={}, content=[]):
@@ -414,6 +424,7 @@ def setup(app):
     app.add_role('issue', issue_role)
     app.add_role('gh', gh_issue_role)
     app.add_role('source', source_role)
+    app.add_role('cve', cve_role)
     app.add_directive('impl-detail', ImplementationDetail)
     app.add_directive('deprecated-removed', DeprecatedRemoved)
     app.add_builder(PydocTopicsBuilder)