ZooKeeper fixes two ACL bypasses in rarely reviewed code paths

Apache ZooKeeper 3.9.6 and 3.8.7 patch two access-control bypasses: CVE-2026-79993 lets any TCP client delete empty znodes without ACL checks via the deleteContainer opcode, and CVE-2026-59739 leaks paths through watch replay on reconnect. Both are rated 7.5.

• CVE-2026-79993: empty znode deleted without ACL check via opcode 20
• CVE-2026-59739: incomplete fix for CVE-2024-23944 in DataTree.setWatches()
• Affected: 3.9.0–3.9.5 and 3.8.0–3.8.6; fixed in 3.9.6 and 3.8.7
• CVE-2026-84439 and CVE-2026-84501 (5.3) allow log injection