Remove mod_http2/mod_md from Apache images, add build gate (CVE-2026-119618)

mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE;
AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a
container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends),
so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and
shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module,
proxy_http2_module or md_module is loadable or `httpd -t` fails, writes
/etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

Dockerfile.fpm

@@ -83,6 +83,11 @@ RUN sed -i "s/rhel\$releasever-amd64/rhel\$releasever-$(uname -m | sed s/x86_64/
 # Set up cron job for log rotation
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
 
+# CVE-2026-119618: this image carries httpd-core only (no mod_http2/mod_md). The
+# gate keeps it that way and records the version in /etc/whp-httpd-version.
+RUN /scripts/httpd-h2-md-gate.sh remove && /scripts/httpd-h2-md-gate.sh check
+LABEL org.whp.httpd-h2-md="removed"
+
 EXPOSE 9000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \