Implement narrow distro TLS policy support for Amazon Linux 2023

[WillChilds-Klein]

Summary

This change uses the narrow approach for distro TLS policy support.

• add a default-off ENABLE_DISTRIBUTION_TLS_POLICY build flag for opt-in distro policy handling
• apply distro-managed TLS policy in libssl only, directly from SSL_CTX_new, for Amazon Linux 2023 and Fedora-compatible crypto-policies backends
• fail open on missing, malformed, or partially unsupported policy content and report warnings through the OpenSSL error queue only
• add focused unit coverage plus AL23 CI jobs for x86_64 and aarch64

Testing

• cmake -GNinja -B build-security-policy -DENABLE_DISTRIBUTION_TLS_POLICY=ON -DCMAKE_BUILD_TYPE=Release .
• cmake --build build-security-policy --target ssl_test -j 4
• ./build-security-policy/ssl/ssl_test --gtest_filter=SSLSystemPolicyTest.*

[github-actions]

🔒 Security Review — View Report

Please review before merging.