[release-branch.go1.25] update openssl backend to point to new location

[gdams]

No description provided.

[Copilot]

Pull request overview

This PR updates the Microsoft Go crypto backend integration to reference the OpenSSL backend from its new module location (github.com/microsoft/go-crypto-openssl) and refreshes the FIPS documentation links accordingly.

Changes:

• Update linker internal-link allowlist entries to the new vendored OpenSSL backend paths.
• Switch crypto backend patch imports from golang-fips/openssl/v2 to microsoft/go-crypto-openssl packages.
• Update FIPS documentation to reference the new OpenSSL backend repository.

Show a summary per file

File	Description
patches/0004-Use-crypto-backends.patch	Updates internal-link allowlist entries for vendored OpenSSL backend packages.
patches/0003-Implement-crypto-internal-backend.patch	Repoints imports/usages in the crypto backend implementation from golang-fips/openssl/v2 to go-crypto-openssl.
eng/doc/fips/UserGuide.md	Updates the OpenSSL backend repo link reference.
eng/doc/fips/README.md	Updates OpenSSL backend module references and removes the old golang-fips/openssl link entry.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

patches/0003-Implement-crypto-internal-backend.patch:2003

• This file now imports github.com/microsoft/go-crypto-openssl/osslsetup, but it still refers to openssl.Init and openssl.CheckVersion later in the patch. That identifier will be undefined and the build will fail; switch those references to osslsetup.Init/osslsetup.CheckVersion (or import osslsetup with an alias named openssl).

+import (
+	"syscall"
+
+	"github.com/microsoft/go-crypto-openssl/osslsetup"
+)

patches/0003-Implement-crypto-internal-backend.patch:2466

• The FIPS-mode check calls openssl.FIPS() and mentions openssl.FIPSCapable in the comment, but go-crypto-openssl exports the FIPS-capability check from the osslsetup package (osslsetup.FIPS) and does not define FIPS/FIPSCapable on the openssl package. As written this won’t compile and the comment is misleading; call osslsetup.FIPS() here and update the comment to match the new API/semantics.

+	// In this cases, openssl.FIPS would return `false` and openssl.FIPSCapable would return `true`.
+	// We don't care about the `fips=yes` property as long as the provider is FIPS-compliant, so use
+	// openssl.FIPS to determine whether FIPS mode is enabled.
+	if err := fips140.Check(func() bool { return openssl.FIPS() }); err != nil {
+		// This path can be reached for the following reasons:

• Files reviewed: 4/5 changed files
• Comments generated: 3