fix: disable session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619)

PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.

tests/test_templates.sh

@@ -216,6 +216,10 @@ test_uploads_default() {
         echo "  FAIL  uploads default: expected 30 max_execution_time"
         return 1
     fi
+    if ! echo "$output" | grep -q "session.upload_progress.enabled = Off"; then
+        echo "  FAIL  uploads default: expected session.upload_progress disabled"
+        return 1
+    fi
     echo "  PASS  uploads default"
 }