[CLK 6.18] spec: Enable Rocky 10 builds

[bmastbergen]

    crypto: rng - Fix double percpu offset in local_unlock() calls

    local_unlock() is supposed to take a percpu pointer, which it then offsets
    for the current CPU. The problem is that the per-CPU DRBG code passes
    local_unlock() a pointer that has *already been offset for the current
    CPU*, so the percpu offset gets added twice. `pcri` is the percpu pointer
    and `cri` is the offset `pcri` pointer for the current CPU; passing `cri`
    to local_unlock() results in the current CPU's offset getting added again
    and thus the resulting pointer is garbage.

    This went unnoticed at runtime because local_unlock() only dereferences
    that pointer on PREEMPT_RT or CONFIG_DEBUG_LOCK_ALLOC=y kernels. The
    pointer is never actually used otherwise.

    This also went unnoticed at compile time because, for x86_64, __percpu only
    expands to something on GCC 14+; __percpu is otherwise an empty macro. So
    there's no pointer type mismatch detected at compile time on older GCC
    versions. On GCC 14+, the following compile error occurs:

      ../crypto/rng.c: In function 'lock_default_rng':
      ../include/linux/percpu-defs.h:221:45: error: initialization from pointer to non-enclosed address space

    Fix it by using __local_unlock() instead, which eliminates the duplicate
    per-CPU offset addition. While using local_unlock() with `pcri` also works,
    using `cri` with __local_unlock() is leaner because it doesn't need to redo
    the offset addition, saving an instruction on kernels that actually use the
    pointer.

    Signed-off-by: Sultan Alsawaf <sultan@ciq.com>

    spec: use %{rhel} for el version and conditionally use system bindgen

    Replace the hardcoded el_version with %{rhel} directly, which is set
    automatically by the buildroot.  This allows the same branch to produce
    el9 packages in a Rocky 9 mock and el10 packages in a Rocky 10 mock.

    Update generate_tarball.sh to accept the el version as an optional CLI
    argument (e.g. ./generate_tarball.sh 10), falling back to rpm --eval
    '%{rhel}' when not specified.

    On Rocky 10, use the system bindgen-cli package (available in CRB)
    instead of building from the bundled source tarball.

    Extend the RPM Build CI workflow to validate builds for both Rocky 9
    and Rocky 10 by adding el_version as a matrix dimension.

Replaces #1526

[PlaidCat]

[ajorgens-ciq]

.yaml and .spec changes look exactly right