Add a reader for the system crypto-policies OpenSSL back-end

[WillChilds-Klein]

Stack, split out of #3442, to merge bottom-up (#3501, the error-queue primitives, has landed):

1. Add a reader for the system crypto-policies OpenSSL back-end #3502 -- policy file reader (this PR)
2. Export the crypto-policies reader and add its CI job #3527 -- shared-build symbol export and CI
3. Seed cipher lists and version bounds from the system crypto policy #3503 -- cipher lists and version bounds
4. Seed groups and signature algorithms from the system crypto policy #3504 -- groups and signature algorithms
5. Keep AWS-LC's post-quantum defaults unless the policy opts out #3505 -- post-quantum defaults

Description

• Adds an off-by-default build flag, -DENABLE_CRYPTO_POLICIES, and a reader for the OpenSSL back-end file that Amazon Linux 2023 and Fedora render from the operator's chosen system policy.
• AWSLC_CRYPTO_POLICY_FILE relocates that file at build time and is declared in the CMake cache, so cmake -L and cmake-gui list it for a packager who is not reading the CMakeLists.
• Parses the directives AWS-LC could act on into a fixed-size config struct. Nothing consumes the result yet.
• Comments, section headers, and unknown keys are ignored, so the reader tolerates the rest of what the framework writes today and whatever it adds later. A value too long to represent is ignored the same way, even where an earlier line set the same key.
• The reader succeeds only if it read the whole file, so half a policy cannot pass for a shorter one.
• The policy path is fixed at build time and overridable at runtime, which is how the tests here and in the rest of the stack drive it. The override is dropped in a secure execution, where the environment sits on the far side of a privilege boundary from the root-owned default path.

Testing / verification

• Parse tests cover a full stock policy, quoting, surrounding whitespace, a repeated key, and a final line with no trailing newline.
• An overlong value or line is dropped whole rather than truncated, and drops the value an earlier line gave the same key, so a policy larger than the reader's buffers cannot quietly become a different policy.
• A missing file, a read error, and null arguments all fail rather than yielding a half-filled config. The read-error case opens a directory, which fails on the first read rather than on the open.
• The runtime path override is exercised directly, since every later test in the stack rests on it.
• Checked the override drop against a real binary: honored as an ordinary process, ignored once that binary carries file capabilities, which leave the real and effective ids equal.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.41%. Comparing base (973b592) to head (c8c14aa).
⚠️ Report is 13 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3502      +/-   ##
==========================================
+ Coverage   78.37%   78.41%   +0.03%     
==========================================
  Files         700      700              
  Lines      125744   125758      +14     
  Branches    17388    17384       -4     
==========================================
+ Hits        98553    98612      +59     
+ Misses      26318    26275      -43     
+ Partials      873      871       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

The merge-base changed after approval.

[skmcgrail]

I think there is a gap in behavior for the scenario where there is a valid value, and then an over-long value following it. The old valid value is retained and does not cause it to be treated as "not-present" based on the last key winning logic.

example: "Groups = X25519\nGroups = <1025 chars>"

[WillChilds-Klein]

so in that case, we'd "fail open" and fall back to AWS-LC's defualts. over-large value is an unlikely edge case; that behavior seems appropriate to me.