CVE-2026-87862 – Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silen

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child’s valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.