Remove mod_http2/mod_md from Apache images, add build gate (CVE-2026-119618)

mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE;
AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a
container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends),
so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and
shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module,
proxy_http2_module or md_module is loadable or `httpd -t` fails, writes
/etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

scripts/httpd-h2-md-gate.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# CVE-2026-119618 (mod_http2 assign_headers heap corruption, httpd 2.4.55-2.4.70)
+# defense in depth. Nothing in WHP needs HTTP/2 or mod_md inside a container: the
+# HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends, and certificates
+# come from the edge, not mod_md. So the modules are removed from every
+# Alma-based Apache image and this gate fails the build if they ever come back.
+#
+#   httpd-h2-md-gate.sh remove   uninstall mod_http2 / mod_md RPMs (if present)
+#   httpd-h2-md-gate.sh check    fail unless the modules cannot load, `httpd -t`
+#                                passes, and record the httpd version
+#
+# Both are idempotent and safe on images with no Apache at all (a no-op).
+set -euo pipefail
+
+BAD_MODULES='http2_module|proxy_http2_module|md_module'
+MOD_PKGS='mod_http2 mod_md'
+
+cmd_remove() {
+  local p present=()
+  for p in $MOD_PKGS; do
+    rpm -q "$p" >/dev/null 2>&1 && present+=("$p")
+  done
+  if [ "${#present[@]}" -gt 0 ]; then
+    dnf remove -y "${present[@]}"
+  fi
+  # Belt and braces if a package was removed but a module file was left behind.
+  rm -f /etc/httpd/conf.modules.d/10-h2.conf /etc/httpd/conf.modules.d/10-proxy_h2.conf \
+        /etc/httpd/conf.modules.d/*-md.conf \
+        /usr/lib64/httpd/modules/mod_http2.so /usr/lib64/httpd/modules/mod_proxy_http2.so \
+        /usr/lib64/httpd/modules/mod_md.so
+}
+
+cmd_check() {
+  local p mods v fail=0
+  command -v httpd >/dev/null 2>&1 || { echo "gate: no httpd binary" >&2; exit 1; }
+  for p in $MOD_PKGS; do
+    if rpm -q "$p" >/dev/null 2>&1; then echo "gate FAIL: RPM $p is installed" >&2; fail=1; fi
+  done
+  # Anchored on the module name column ("systemd_module" must NOT match md_module).
+  mods=$(httpd -M 2>/dev/null) || { echo "gate FAIL: httpd -M failed" >&2; exit 1; }
+  if printf '%s\n' "$mods" | grep -E "^ (${BAD_MODULES}) "; then
+    echo "gate FAIL: HTTP/2 or mod_md module still loadable" >&2; fail=1
+  fi
+  [ "$fail" -eq 0 ] || exit 1
+  httpd -t
+  v=$(rpm -q --qf '%{VERSION}-%{RELEASE}' httpd-core)
+  printf '%s\n' "$v" > /etc/whp-httpd-version
+  echo "gate OK: httpd-core ${v}; no http2/proxy_http2/md modules; httpd -t passes"
+}
+
+case "${1:-}" in
+  remove) cmd_remove ;;
+  check)  cmd_check ;;
+  *) echo "usage: $0 remove|check" >&2; exit 2 ;;
+esac