postgresql: update to 18.6

postgresql: update to 18.6

Security release from 18.4 (18.5 was never released, pulled post-wrap
due to a regression). A dump/restore is not required for those running
18.x, but see the migration notes below for the first three security
fixes, GIN index reltuples corruption, and btree_gist/ltree reindexing.

- restrict logical decoding output plugins to a new
  output_plugin_libraries allowlist; previously a replication user
  could load any library for logical decoding (CVE-2026-6471)
- fix contrib/pgcrypto PGP encryption to detect unsupported ciphers;
  previously an OpenSSL cipher rejection (e.g. FIPS mode) was ignored
  and pgcrypto silently XORed plaintext instead of encrypting it
  (CVE-2026-14663)
- fix psql to skip in-line data following a scripted
  "COPY ... FROM STDIN" even when the COPY fails before
  PGRES_COPY_IN, closing a SQL-injection hazard in scripts that
  exercise failing COPY commands (CVE-2026-6464)
- cross-check the output row type of a portal running EXECUTE/FETCH;
  divergent declared row types between the outer and inner portal
  could lead to server memory disclosure and arbitrary code execution
  (CVE-2026-16239)
- fix a buffer overrun with a long time zone abbreviation in
  to_char(), which could crash the server or be exploited for
  arbitrary code execution (CVE-2026-14669)

Plus a variety of other fixes from 18.4; see the upstream release notes
for the complete list.

Signed-off-by: Daniel Golle <redacted>