upstream XSA patches do not apply to the latest stable release nor the
tip of the stable branch, since they're already there, and the

  update Xen version to 4.18.4-pre

commit does not immediately follow the 4.18.3 release tag, so we have to
create two patches like so:

  git format-patch 868a098^..641b8f2 --output xen-stable-4.18-20240924.patch
  git format-patch 6c2827e^..1cbeb62 --output xen-stable-4.18-20241112.patch