CVE-2026-116155: ImageMagick Memory Leak via Crafted XMP Profile in ParseInternalDoctype

ParseInternalDoctype stores parameter-entity values from an XMP DOCTYPE internal subset in a local vector, frees the vector at xml-tree.c:1565, but never destroys the owned value strings — every <!ENTITY %> value is leaked on both the success and error paths.

Upgrade to ImageMagick 7.1.2-33 or 6.9.13-58, and as a stopgap reject XMP profiles via policy.xml.