Support ubi-10 by switching iptables-nft/iptables to Recommends instead of Requires on rhel-10, closes #1348

[Spitfire1900]

- What I did
Support UBI 10 by only Recommending iptables-nft or iptables on RHEL 10 instead of requiring it.

- Description for the changelog

Support UBI 10 by only Recommending iptables-nft or iptables on RHEL 10 instead of requiring it.

Current master

root@c7ee0f9e034c:/docker-ce-packaging# git log -n 1
commit a527854131ce458b50d6c294eca4879fc6e7d8db (HEAD -> master, origin/master, origin/HEAD)
Merge: b191a14 671e782
Author: Sebastiaan van Stijn <thaJeztah@users.noreply.github.com>
Date:   Wed Sep 9 21:12:49 2026 +0200

    Merge pull request #1352 from vvoland/update-distro
    
    deb: Drop Debian 11 Bullseye support
root@c7ee0f9e034c:/docker-ce-packaging# make IMAGE=registry.access.redhat.com/ubi10/ubi verify 2>&1 | grep -A 6 'Error:'
Error: 
 Problem 1: conflicting requests
  - nothing provides (iptables-nft or iptables) needed by docker-ce-3:0.0.0~20260915112113.4a63305-0.el10.x86_64 from @commandline
 Problem 2: package docker-ce-rootless-extras-0.0.0~20260915112113.4a63305-0.el10.x86_64 from @commandline requires docker-ce, but none of the providers can be installed
  - conflicting requests
  - nothing provides iptables needed by docker-ce-3:28.5.0-1.el10.x86_64 from docker-ce-test
  - nothing provides iptables needed by docker-ce-3:28.5.1-1.el10.x86_64 from docker-ce-test

This branch:

root@c7ee0f9e034c:/docker-ce-packaging# git log -n 1
commit 1ab0c2cac9e87dea1f4ac1be5d4a7184e735584f (HEAD -> ubi-10-support, origin/ubi-10-support)
Author: Gottfried, Kyle <6462596+Spitfire1900@users.noreply.github.com>
Date:   Wed Sep 16 19:31:02 2026 -0400

    Support ubi 10, closes <C2><96>#1348
    
    Signed-off-by: Gottfried, Kyle <6462596+Spitfire1900@users.noreply.github.com>
root@c7ee0f9e034c:/docker-ce-packaging# make IMAGE=registry.access.redhat.com/ubi10/ubi verify                          
docker run  --rm -i \
        -v "$(pwd):/v" \
        -e DEBIAN_FRONTEND=noninteractive \
        -e PACKAGE_REPO=prod \
        -w /v \
        registry.access.redhat.com/ubi10/ubi ./verify
+ verify
...
+ runc --version
runc version 1.5.1
commit: v1.5.1-0-g8f2685a4
spec: 1.3.0
go: go1.26.8
libseccomp: 2.5.6
root@c7ee0f9e034c:/docker-ce-packaging# echo $?
0

[Spitfire1900]

Note that on UBI 10, Docker must currently be started with dockerd --firewall-backend=nftables, because UBI 10 does not provide the iptables package required by Docker's default firewall backend.

This PR does not make the default iptables backend functional on UBI 10. It changes the RHEL 10 RPM dependency from Requires to Recommends, allowing Docker CE to be installed without iptables. On RHEL 10 systems where an iptables provider is available, the recommendation should still cause it to be installed.

The nftables backend is currently experimental and has some limitations versus the default backend, notably lack of Swarm/overlay-network support.