ActiveState Release of Python 2.7.18.16 rc1

Release candidate for Windows/legacy-platform testing of 2.7.18.16. Not final.

Built on top of 2.7.18.15, with 17 security fixes:

PR	Fix	CVE
#92	tarfile streaming-mode seek loops at EOF	CVE-2026-11972
#93	csv.Sniffer quadratic regex	CVE-2026-18503
#94	ftplib.ftpcp() trusts the PASV host	CVE-2026-8328
#95	httplib Content-Length / chunk-size validation	CVE-2026-103995
#96	httplib limits for 100 Continue headers, interim responses and trailers	CVE-2021-3737, GHSA-w4q2-g22w-6fr4
#97	SimpleHTTPServer // open redirect	CVE-2021-28861
#98	mimetypes reads fixed paths on Windows	CVE-2024-3220
#99	pyexpat stack overflow on nested content models	CVE-2026-4224
#100	bz2 decompressor and BZ2File reused after an error	CVE-2026-9669
#101	ElementPath index predicates are O(n²)	CVE-2026-6879
#102	urllib2 sends https credentials over http	CVE-2026-15806
#103	HTMLParser incremental feed is quadratic	CVE-2026-15308
#104	bundled Expat 2.6.4 → 2.9.0	30 Expat CVEs
#105	16-byte random Expat hash salt	CVE-2026-7210
#106	ssl SNI callback use-after-free	CVE-2026-19445
#107	unicodedata.normalize() quadratic	CVE-2026-3276
#108	os.mkdir(path, 0700) / mkdtemp ACL on Windows	CVE-2024-4030

The release also includes the review follow-ups in #111: the _socket link failure in unoptimized builds, an SNI reference count, and test_ssl no longer needing mock.

What to check on Windows x64:

• The build: in particular the _elementtree project, which now compiles Expat 2.9.0's xcs.c with XML_POOR_ENTROPY.
• Expat version: the external Expat that pyexpat links must be at least 2.8.0, and should be 2.9.0.
• Windows-only tests: test_os.MakedirTests.test_win32_mkdir_700, test_tempfile.test_mkdtemp.test_mode_win32 and test_mimetypes.

Linux x86_64, against OpenSSL 1.1.1w: compared with 2.7.18.15, the full suite shows no regressions. Windows x64 has not been tested yet.