thunderbird: security update to 149.0

### Affected package (and version) `thunderbird` (148.0) ### CVE ID(s) CVE-2026-3889, CVE-2026-4371, CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4687, CVE-2026-4688, CVE-2026-4689, CVE-2026-4690, CVE-2026-4691, CVE-2026-4692, CVE-2026-4693, CVE-2026-4694, CVE-2026-4695, CVE-2026-4696, CVE-2026-4697, CVE-2026-4698, CVE-2026-4699, CVE-2026-4700, CVE-2026-4701, CVE-2026-4722, CVE-2026-4702, CVE-2026-4723, CVE-2026-4724, CVE-2026-4705, CVE-2026-4706, CVE-2026-4707, CVE-2026-4708, CVE-2026-4709, CVE-2026-4710, CVE-2026-4711, CVE-2026-4725, CVE-2026-4712, CVE-2026-4713, CVE-2026-4714, CVE-2026-4715, CVE-2026-4716, CVE-2026-4717, CVE-2026-4726, CVE-2025-59375, CVE-2026-4727, CVE-2026-4728, CVE-2026-4718, CVE-2026-4719, CVE-2026-4720, CVE-2026-4729, CVE-2026-4721 ### Severity High ### Other security advisory ID(s） - https://www.mozilla.org/en-US/security/advisories/mfsa2026-23/ ### Description/References See above. ### Patch(es)/Solution(s) Update to 149.0.