Draft: In-flight upstream security bits

This is just a draft MR so we can include in releases the security fixes which Linus has not pulled in yet. They seem to be changing rapidly, so instead of an MR per issue, I will just keep this one as rolling.