[3.13] Backport request: gh-143923 poplib control-character rejection (CVE-2025-15367) #160731

Requesting a 3.13 (and 3.14, which also lacks it) backport of the gh-143923 fix (commit b234a2b, main, 2026-01-20, Seth Larson): reject control characters in POP3 commands.

CVE-2025-15367 (poplib command injection via newlines) remains exploitable on the 3.13 line: I verified against 3.13.5 that _putcmd('USER foo\\r\\nDELE 1') writes the injected bytes to the wire, and that git log origin/3.13 origin/3.14 -- Lib/poplib.py shows nothing newer than gh-130637. OSV has no fixed version anywhere; Debian trixie/forky/sid all still vulnerable.

The fix cherry-picks cleanly onto current origin/3.13 (Lib/poplib.py hunk byte-identical, one import-block conflict in Lib/test/test_poplib.py only; the control_characters_c0 test helper already exists on 3.13). I confirmed functionally that the backported gate rejects CRLF/NUL/CR injections with ValueError while clean commands pass through byte-identical.

Happy to open the backport PR if a core dev can sponsor it.