Security implications of 1.2.0 unclear

The most recent version of Brotli has this ALL CAPS note in the changelog:

```
## [1.2.0] - 2025-10-27

### SECURITY
- python: added `Decompressor::can_accept_more_data` method and optional
`output_buffer_limit` argument `Decompressor::process`;
that allows mitigation of unexpectedly large output;
reported by Charles Chan (https://github.com/charleswhchan)
```

It _seems_ from these notes that a user of the Python brotli package would actually need to change their usage (as well as update) but how is not made abundantly clear.

Side note: my git archeology is being hampered by the fact that this note seems to predate the actual release by almost a year. In similar vein: their seems to be a gap between 2025-10-27 and the moment this actually made it to PyPI

Start with the 1.2.0 changelog entry and the Python Decompressor APIs named there: can_accept_more_data and process with output_buffer_limit. Clarify whether users must change their usage, document the mitigation, and explain the release and PyPI timeline; done means the security impact and upgrade guidance are unambiguous.

Written by the indexing model from the issue text.