[release-branch.go1.27] Support ML-KEM with OpenSSL 3.3

[George Adams (gdams)]

Backport of #2492 to microsoft/release-branch.go1.27.

Upgrade the OpenSSL backend to bring microsoft/go-crypto-openssl#68.

The release branch dependency was updated directly and the patch series was regenerated with git go-patch extract.

Validation:

• git go-patch extract patch verification
• OpenSSL package build on macOS arm64 with cgo enabled and disabled
• OpenSSL package cross-build for Darwin amd64 and Linux amd64 with cgo disabled

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The change is a large cryptography-related vendor upgrade/regeneration where correctness depends on extensive external code behavior across platforms and build modes.

Review tier: Lite
Findings: None

What changed in this PR

Backports the OpenSSL backend upgrade from upstream PR #2492 onto microsoft/release-branch.go1.27, pulling in the go-crypto-openssl changes needed for ML-KEM support with OpenSSL 3.3 and regenerating the patch series via git go-patch extract.

Changes:

• Bumps github.com/microsoft/go-crypto-openssl to a newer pseudo-version and updates related module sums and vendored module metadata.
• Updates vendored go-crypto-openssl sources, including new fakecgo thread-entry shims and OpenSSL 3 provider-based key construction paths (e.g., EVP_PKEY_CTX_new_from_name).
• Regenerates the vendor patch contents to reflect the dependency update (file list, generated sources, and symbol wrappers).

Patch consistency check: Patches are happy!

File	Description
patches/​0001-Vendor-external-dependencies.patch	Updates module versions/sums and refreshes vendored go-crypto-openssl code to incorporate OpenSSL 3.3 ML-KEM support.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.