CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs

10 days is a very long time for such a critical security update, and we need to be better for the next time this happens.