feat(openssl): split FIPS provider into separate package

[tobiasb-ms]

Extract the FIPS provider module (fips.so) from the openssl package into a new openssl-fips-provider package, using the upstream fipsinstall approach for integrity verification instead of embedded HMAC.

AB#21687

New package: openssl-fips-provider

Built from the same openssl source with enable-fips. Ships:

• /usr/lib64/ossl-modules/fips.so
• /etc/pki/tls/fipsmodule.cnf (generated by fipsinstall post-strip)
• /etc/pki/tls/openssl.d/openssl-fips-provider.cnf (drop-in config)

The drop-in registers the fips provider in [provider_sect] and includes fipsmodule.cnf, making the provider loadable via openssl ... -provider fips without requiring kernel FIPS mode.

Changes to openssl

• Remove enable-fips from ./Configure (fips.so no longer built here)
• Drop patch 0018 (re-enables fipsinstall subcommand)
• Replace patch 0019 with simplified version: kernel FIPS mode just activates fips+base providers and sets FIPS properties, relying on the drop-in for config rather than loading fips_local.cnf directly
• Replace patch 0037 with rebased version (context conflict with 0018 removal in doc/man5/fips_config.pod)
• Remove fips_local.cnf (no longer needed; drop-in provides config)
• Remove hmac-ify call in %check (no fips.so to process)
• Keep Requires: openssl-fips-provider on openssl-libs

Config model

• openssl.d drop-in: makes provider loadable (registers fips_sect, includes MAC data from fipsmodule.cnf)
• Patch 0019: auto-activates fips+base in kernel FIPS mode
• Crypto-policies: NOT included in drop-in (activation via update-crypto-policies is a separate concern)

Patch differences between openssl and openssl-fips-provider

Both packages share the same upstream source and nearly all patches.

Dropped from both:

• 0018 (FIPS-disable-fipsinstall): fipsinstall must work in both

Dropped only from openssl-fips-provider:

• 0020 (FIPS-INTEG-CHECK-Embed-hmac-in-fips.so): embedded HMAC integrity check, replaced by fipsinstall/fipsmodule.cnf approach
• 0022 (FIPS-INTEG-CHECK-Execute-KATS-before-HMAC): KAT reordering for embedded HMAC verification, irrelevant without 0020
• 0053 (Allow-hybrid-MLKEM-in-FIPS-mode): touches defltprov.c and libcrypto internals only — not compiled into fips.so

Patches 0020/0022 remain in openssl because the patched files (providers/fips/self_test.c) exist in the source tree but are not compiled without enable-fips — they are inert and removing them would add overlay complexity for no functional benefit. Patch 0053 is guarded by a %{defined azurelinux} conditional in openssl only.

Identical in both (same file content):

• 0019 (FIPS-Force-fips-provider-on): simplified to just activate providers in kernel FIPS mode, drop fips_local.cnf loading
• 0037 (FIPS-TLS-Enforce-EMS): rebased fips_config.pod hunk against full upstream file (old version depended on 0018's gutting)

These patches modify code in libcrypto/libssl (not fips.so), so their content is functionally irrelevant to the fips-provider build — they just need to apply cleanly. Unified to reduce maintenance surface.