fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619)

PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.

compose.yml

@@ -63,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=4.1.1+7.1.3"
+        - "coop-cloud.${STACK_NAME}.version=4.1.2+7.1.3"
 
   db:
     image: "mariadb:13.0"