Shopware NGINX Hardening (CVE-2026-104937)

## Description

[CVE-2026-104937](https://www.cve.org/CVERecord?id=CVE-2026-104937) is a vulnerability in how Shopware sites serve uploaded media.
Shopware's media upload accepts HTML files, and those files are served back from your shop's own domain.
If an uploaded file contains a script, that script runs when someone opens the link.
SVG files can carry scripts the same way.
Someone with media upload access can upload a malicious file, and when an admin opens it, the script steals that admin's session.
If that admin can manage extensions, the attacker can then install a malicious plugin and run code on your server.
CERT/CC has published a [vulnerability note](https://kb.cert.org/vuls/id/157374) with more details.

Shopware's fix for this is a [change to their recommended NGINX configuration](https://github.com/shopware/docs/pull/2613), and this patch applies it to your Shopware sites.
Uploaded HTML and SVG files are now served with a header that stops the browser from running scripts or submitting forms inside them.
This patch also blocks PHP files from being run out of the public media and asset folders.

!!!warning Warning
Interactive HTML pages or script-based SVGs served from `/media` will have their scripts and forms blocked.
If your media is served from a separate CDN or S3 URL, that CDN needs to add the same header itself.
If a CDN like Cloudflare caches your HTML or SVG files, purge it after this patch is applied.
If this does affect your deployment, please reach out to support@jetrails.com and we'll work with you to mitigate any impact.
!!!

## Impact

There is no downtime expected.
The NGINX configuration is checked and then reloaded on the web nodes.
If your deployment uses Varnish, it's restarted, which clears its whole cache so HTML and SVG files are fetched again with the new header.
Pages will load from your web nodes until the cache warms back up.

## Changes

- Updates the NGINX config of every Shopware site on your deployment with the hardening rules.
- Makes sure new sites created on this deployment get it too.
- Checks the NGINX configuration and reloads it on the web nodes.
- Restarts Varnish to clear its cache, if your deployment uses it.

## If You Accept

Uploaded HTML and SVG files can no longer run scripts on your shop's domain, which closes the admin session theft path in CVE-2026-104937.
PHP files placed in the public media and asset folders can't be executed.
Product images and the rest of your storefront are unaffected.
To further reduce risk, limit media upload and extension management permissions to trusted admin users, as CERT/CC recommends.

## If You Reject

Anyone with media upload access can still plant an HTML or SVG file that steals an admin's session when it's opened.
That can escalate to running code on your server through a malicious plugin.