Add native OpenSSL 3.5 X25519MLKEM768 KEM backend

[adityasoni99]

Summary

Adds a native OpenSSL 3.5+ ML-KEM backend for the X25519MLKEM768 hybrid group, so post-quantum key exchange no longer requires liboqs when a 3.5+ provider is available.

fizz::openssl::OpenSSLKemKeyExchange implements the KeyExchange interface using stock OpenSSL public APIs (EVP_PKEY_CTX_new_from_name/EVP_PKEY_keygen + EVP_PKEY_encapsulate/EVP_PKEY_decapsulate). OpenSSL performs the X25519 + ML-KEM-768 combine internally, so no fizz-side hybrid is needed.

Details

• Client keygen + decapsulate, server encapsulate; KEM roles mapped onto KeyExchangeRole. clone() uses EVP_PKEY_up_ref.
• Fully gated behind OPENSSL_VERSION_NUMBER >= 0x30500000L plus a runtime provider-availability check; non-3.5 builds are unaffected.
• MultiBackendFactory prefers the native path when available and falls back to the existing liboqs path otherwise.
• Unit tests: KEM round-trip shared-secret equality, clone, expected sizes, malformed-input negatives, and factory negotiation. Registered in CMake, FizzSources, and BUCK.

Testing

Built against OpenSSL 3.5.8 from source. New suite passes 6/6; baseline ECKeyExchange (54/54) and X25519 (4/4) unaffected.

Closes #169

[meta-cla]

Hi @adityasoni99!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!