Update nginx to 1.30.4 to fix CVE-2026-42533 (5.0 branch)

[Mosherfist]

Follow-up to #1663 for the 5.0 branch, per @danielxdd's request.

Summary

Bumps nginx from 1.26.3 to 1.30.4 on the 5.0 branch to fix
CVE-2026-42533, a critical heap buffer overflow (CVSS 9.2) in nginx's
map directive regex handling.

Changes

• SPECS/90/nginx/nginx.spec: version 1.26.3 → 1.30.4, Release reset to 1
• SPECS/90/nginx/config.yaml: updated archive metadata for 1.30.4
• Dropped six CVE backport patches (CVE-2025-53859, CVE-2026-27654,
  CVE-2026-32647, CVE-2026-27651, CVE-2026-27784, CVE-2026-1642) that
  were applied on top of 1.26.3 — all six are included upstream in
  1.30.4, so re-applying them would either be redundant or fail to
  apply against the updated source.

References

• https://nginx.org/en/CHANGES (entry for 1.31.3, 15 Jul 2026)
• Related: Update nginx to 1.30.4 to fix CVE-2026-42533 #1663 (main branch)

Testing

Not build-tested locally (RPM toolchain build not set up on my
machine); relying on CI for build validation.

[legal-compliance-bot]

🛑 Legal Compliance Check Failed

Hi @Mosherfist, thank you for your contribution!

To merge this Pull Request, you must sign our DCO.

Note: Even if you signed off your commits locally (using git commit -s), you must post the comment below to register your signature with our automated system.
Note: This is a one-time process. Once signed, future contributions to this repository will be verified automatically.

1. Read the Document: Click here to read the DCO
2. Sign via Comment: Copy and paste the exact line below into a new comment on this Pull Request:

I have read the DCO Document and I hereby sign the DCO for this and all future contributions.

---

⏳ Processing Schedule:
Our 'Compliance Sweeper' runs automatically approximately every 15-20 minutes.
After you post the comment, your status will update automatically during the next scheduled run.
You do not need to take any further action.