support msgpack 1.2.3

[ThomasWaldmann]

Forward port of #10469 (1.4-maint).

Allow msgpack 1.2.3 (released 2026-09-29) in pyproject.toml and is_supported_msgpack().

msgpack 1.2.3 fixes, in the C extension:

• memory leaks when map key validation or container hooks fail (GHSA-j586-36cw-2gc2)
• a use-after-free when cleaning up an incomplete or failed Unpacker.skip()

Behaviour change checked: the C Unpacker now raises ValueError when switching between unpack, skip, header readers or read_bytes() while an object is incomplete, and rejects re-entrant use. borg only uses feed() plus unpack()/iteration, and RobustUnpacker creates a fresh Unpacker for each resync attempt, so borg is not affected.

Tested locally (macOS, Python 3.11, msgpack 1.2.3 C extension): full testsuite, 3304 passed, 1092 skipped; the only 2 failures (bash archive name/id completion tests) fail identically with msgpack 1.2.2 and come from the local test setup (no installed borg entry point).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.73%. Comparing base (4897f70) to head (e84d7ac).
⚠️ Report is 9 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10470      +/-   ##
==========================================
+ Coverage   88.72%   88.73%   +0.01%     
==========================================
  Files         103      103              
  Lines       19388    19392       +4     
  Branches     3023     3024       +1     
==========================================
+ Hits        17202    17208       +6     
+ Misses       1518     1515       -3     
- Partials      668      669       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.