[RFC / Feature Proposal] Relaxing Strict PHP Upper-Bound Enforcement into Configurable Soft Warnings for Emergency Security Mitigations (e.g., `php2shell`)

1. Executive Summary Currently, Nextcloud Server enforces a strict, hardcoded upper-bound PHP version check in lib/versioncheck.php (for example, if (PHP_VERSION_ID >= 80200) in Nextcloud 25). When a newer PHP minor version is detected, Nextcloud immediately terminates execution with HTTP 500 Internal Server Error and exit(1) across all entry points (index.php, remote.php, public.php, cron.php, and console.php / occ). While testing boundaries are important for quality assurance, this unconditional hard block creates a severe operational and security dilemma when critical, zero-day Remote Code Execution (RCE) vulnerabilities are discovered in the PHP runtime itself—such as the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619). In many enterprise Linux distributions and managed/shared hosting environments, security patches for such critical vulnerabilities are only released for actively supported PHP branches (e.g., PHP 8.2.35, PHP 8.3.36), while older EOL PHP branches (e…