- Update debian-base, debian-iptables, setcap images to pick up CVE fixes
  - Debian-base to v1.9.0
  - Debian-iptables to v1.6.7
  - setcap to v2.0.4 (#106147, @cpanato) [SIG Release and Testing]

### Failing Test

- Fixes hostpath storage e2e tests within SELinux enabled env (#105787, @Elbehery) [SIG Testing]

### Bug or Regression

    // This is a valid Type 3 message with proper structure
    private final String type3MessageBase64 = createValidType3Message();

    /**
     * Creates a valid Type 3 NTLM message for testing
     */
    private static String createValidType3Message() {
        // Build a properly formatted Type 3 message
        byte[] message = new byte[200];

        // NTLMSSP signature

    }

    @Test
    @DisplayName("Should handle invalid protocol ID length")
    void testInvalidProtocolIdLength() {
        // Protocol ID is a constant in transform header, not settable
        // Testing invalid protocol ID during decode instead
        byte[] invalidBuffer = new byte[52];
        // Write invalid protocol ID
        invalidBuffer[0] = 0x00;
        invalidBuffer[1] = 0x00;

        assertArrayEquals(newFileId, actualFileId);

        assertEquals(96, bytesWritten); // 32 bytes header + 64 bytes info
    }

    // Helper interface for testing
    private interface TestFileInformation extends FileInformation, Encodable {
    }

import static com.google.common.truth.Truth.assertThat;
import static org.junit.Assert.assertThrows;

import com.google.common.base.Predicate;
import com.google.common.base.Predicates;
import com.google.common.testing.EqualsTester;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.NavigableSet;

import okhttp3.internal.DoubleInetAddressDns
import okhttp3.internal.RecordingOkAuthenticator
import okhttp3.internal.connection.RealConnection
import okhttp3.internal.discard
import okhttp3.testing.Flaky
import okhttp3.testing.PlatformRule
import okhttp3.tls.HandshakeCertificates
import okio.Buffer
import okio.BufferedSink
import okio.GzipSink
import okio.Path.Companion.toPath
import okio.buffer

   *
   * @since 15.0
   */
  public static final MediaType KEY_ARCHIVE = createConstant(APPLICATION_TYPE, "pkcs12");

  /**
   * This is a non-standard media type, but is commonly used in serving hosted binary files as it is
   * <a href="http://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors">
   * known not to trigger content sniffing in current browsers</a>. It <i>should not</i> be used in

import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.mockito.Mockito;

import static org.codehaus.plexus.testing.PlexusExtension.getTestFile;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;

            assertTrue((flags & ServerMessageBlock2.SMB2_FLAGS_SIGNED) != 0, "Signed flag should be set");
        }

        @Test
        @DisplayName("Should preserve other flags when setting signed flag")
        void testSignPreservesOtherFlags() {
            // Set initial flags with some existing flags
            int initialFlags = 0x00000001 | 0x00000002 | 0x00000004;

        if (counts[i] >= 0) {
          sortedCounts[index] += counts[i];
        } else {
          sortedCounts[index] = ~counts[i];
        }
      }
      // Note that we're not getting rid, yet, of elements with count 0.  We'll do that in build().
      this.elements = sortedElements;
      this.counts = sortedCounts;
      this.length = uniques;
    }

    /**