Add opt-in system crypto-policies seeding for SSL_CTX (broad approach)

[WillChilds-Klein]

Issues:

No existing issue. This is a draft to solicit feedback on approach before investing further.

Description of changes:

AWS-LC deliberately ignores system configuration today. On distributions with the crypto-policies framework (notably Amazon Linux 2023 and Fedora, which share it), an operator selects a system-wide policy that is rendered to an OpenSSL back-end file describing the OS TLS posture. This PR lets AWS-LC optionally honor that policy so applications inherit it without code changes.

This is the "broad" approach: behind a new off-by-default CMake flag (-DENABLE_CRYPTO_POLICIES), every context created by SSL_CTX_new is automatically seeded from the system policy after AWS-LC's built-in defaults, and consumers can still override afterward. It applies the policy's cipher, protocol-version, signature-algorithm, and group directives. Seeding is best-effort and never fatal: a missing or malformed file, or an unsupported directive, is ignored and the built-in default is kept.

Call-outs:

• Broad vs. narrow. This implements the broad, automatic approach (seed on every context creation); the alternative "narrow" approach would add an explicit opt-in call per context with no implicit behavior change. Feedback on which direction AWS-LC prefers is the main purpose of this draft.
• Security levels are dropped. The policy's @SECLEVEL token is parsed and ignored because AWS-LC has no security levels, so only the cipher list is applied and the level's key-size/hash intent is not enforced.
• Unsupported tokens drop a whole directive. If a policy lists a signature algorithm or group AWS-LC lacks, that directive falls back to the built-in default rather than a filtered subset; token-by-token filtering is a possible follow-up.
• FIPS. The flag is orthogonal to -DFIPS=1; it seeds preferences and does not establish FIPS posture.

Testing:

• New unit tests cover parsing and application, security-level stripping, missing/malformed files, DTLS vs TLS selection, and an end-to-end case against the real system policy that skips when absent.
• A new CI job runs the flag-on suite on Amazon Linux 2023 (x86_64/aarch64, gcc and clang), where the end-to-end test validates the real policy file; the bulk suite runs with seeding neutralized so existing tests are unaffected.
• Verified locally: the default (flag-off) build is unchanged, flag-on unit tests pass, and the full ssl suite stays green with a policy present.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.07%. Comparing base (0256162) to head (6a8cad8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3442      +/-   ##
==========================================
- Coverage   78.07%   78.07%   -0.01%     
==========================================
  Files         700      700              
  Lines      124787   124787              
  Branches    17340    17341       +1     
==========================================
- Hits        97432    97427       -5     
- Misses      26489    26494       +5     
  Partials      866      866              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.