Remove mod_http2/mod_md from Apache images, add build gate (CVE-2026-119618)

mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE;
AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a
container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends),
so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and
shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module,
proxy_http2_module or md_module is loadable or `httpd -t` fails, writes
/etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

Dockerfile

@@ -89,6 +89,12 @@ COPY ./configs/whp-security.conf /etc/httpd/conf.d/
 # Set up cron job in a single layer
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
 
+# CVE-2026-119618 defense in depth: no HTTP/2 / mod_md in the image, build fails
+# if they come back or the config no longer parses. scripts/httpd-h2-md-gate.sh.
+# Placed after every other package step so nothing later can re-add them.
+RUN /scripts/httpd-h2-md-gate.sh remove && /scripts/httpd-h2-md-gate.sh check
+LABEL org.whp.httpd-h2-md="removed"
+
 ## Healthy = Apache answered with anything but a 5xx. `curl -f` also failed on
 ## 4xx, so a new site with an empty docroot (403) or an app with no route for /
 ## (404) showed unhealthy forever, and WHP's monitor restarted it as "PHP