Remove mod_http2/mod_md from Apache images, add build gate (CVE-2026-119618)

mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE;
AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a
container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends),
so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and
shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module,
proxy_http2_module or md_module is loadable or `httpd -t` fails, writes
/etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

Dockerfile.shared-httpd

@@ -31,6 +31,7 @@ COPY ./scripts/log-rotate.sh /scripts/log-rotate.sh
 COPY ./scripts/entrypoint-shared-httpd.sh /scripts/entrypoint-shared-httpd.sh
 COPY ./scripts/stop-services.sh /scripts/stop-services.sh
 COPY ./scripts/tune-mpm.sh /scripts/tune-mpm.sh
+COPY ./scripts/httpd-h2-md-gate.sh /scripts/httpd-h2-md-gate.sh
 RUN chmod +x /scripts/*
 
 # Generate self-signed SSL cert (same as main CAC image)
@@ -49,6 +50,12 @@ RUN mkdir -p /etc/httpd/conf.d/vhosts
 # Set up cron job for log rotation
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
 
+# CVE-2026-119618 defense in depth: no HTTP/2 / mod_md in the image, build fails
+# if they come back or the config no longer parses. scripts/httpd-h2-md-gate.sh.
+# Placed after every other package step so nothing later can re-add them.
+RUN /scripts/httpd-h2-md-gate.sh remove && /scripts/httpd-h2-md-gate.sh check
+LABEL org.whp.httpd-h2-md="removed"
+
 EXPOSE 80 443
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \