CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries

Earlier versions of the [GeoJSON spec](https://www.rfc-editor.org/info/rfc7946/#section-4)
allowed specifying a coordinate reference system (CRS) by URL. Since GDAL still resolves these
URLs, any validation, save, or query path where a geometry is instantiated from
user input allowed an attacker to submit a malicious CRS that would make a
network request as the Django process user, or read a file, or both.

Lookups against spatial fields, the `GeometryField` form field, and `GEOSGeometry` now
reject GeoJSON geometries with CRS references to external resources. The `DataSource` and
`LayerMapping` utilities for loading trusted data continue to accept these values.

This issue has severity "moderate" according to the [Django Security Policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks to Submersion Security Research Team for the report.