CVE-2026-108147: Potential memory exhaustion in `MultiPartParser` via base64-encoded file upload

When using `django.http.multipartparser.MultiPartParser`, multipart uploads

with `Content-Transfer-Encoding: base64` could be buffered entirely in memory,
regardless of `FILE_UPLOAD_MAX_MEMORY_SIZE`, before being passed to upload
handlers, potentially consuming excessive memory.

This issue has severity "low" according to the [Django Security Policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks to Ignacy Kujawa for the report.