Add OpenSSL 3.5 support to provider build and CI

[jenstopp]

Summary

• Add OpenSSL 3.5.0 as a second supported version alongside 3.0.3
• CI now matrix-tests the provider against both versions
• Fix a latent LD_LIBRARY_PATH bug in the CAPI test harness
• Add infrastructure for future 3.5-only test gating

Motivation

OpenSSL 3.5 brings features we need for new features of the HSH lib.
This PR prepares the build and test infrastructure so that 3.5-specific
provider features can be added incrementally without breaking 3.0 support.

What changed

CI (.github/workflows/rust.yml)

• provider_integration job uses matrix.openssl-version: ['3.0.3', '3.5.0']
• 3.5 runs with continue-on-error while stabilising
• All env vars (OPENSSL_DIR, OPENSSL_BIN, OPENSSL_LIB) parameterised
• Bug fix: added missing OPENSSL_LIB to the CAPI test step (was the only
  step without it — masked on 3.0 because system libs are ABI-compatible)

CAPI test harness (openssl_capi_integration_tests.rs)

• Added find_openssl_lib_dir() to resolve the OpenSSL shared library path
• All Command::new(&openssl) calls in setup_keymat() now set
  LD_LIBRARY_PATH so the correct libcrypto.so.3 is found regardless
  of what the system provides

xtask

• openssl_install.rs: parameterised to accept a version string
• integration_tests.rs: added --openssl-version CLI argument
  (default 3.0.3; ignored when OPENSSL_DIR is already set)

Version gating (for future 3.5-only tests)

• Shell tests: require_ossl_version + skip_below_ossl_3_5 helpers in env.sh
• C++ tests: use existing #if OPENSSL_VERSION_MINOR >= 5 pattern (matches provider code)
• No Cargo features needed — gating happens naturally in each test layer

Documentation (plugins/ossl_prov/README.md, xtask/README.md)

• Testing section with env vars, local test commands, version switching
• See plugins/ossl_prov/README.md → Testing for the full guide

[Copilot]

Pull request overview

This PR updates the OpenSSL provider build/test tooling so the repository can build and run provider integration tests against both OpenSSL 3.0.3 and 3.5.0, including CI matrix coverage and local xtask support.

Changes:

• Add an OpenSSL-version selector to cargo xtask integration-tests and parameterize OpenSSL auto-install/build paths.
• Update provider integration test harnesses/scripts to reliably load the intended OpenSSL shared libraries (especially for CAPI tests).
• Expand GitHub Actions CI to matrix-test provider integration against OpenSSL 3.0.3 and 3.5.0 (3.5 allowed to fail while stabilizing), plus documentation updates.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
xtask/src/precheck.rs	Passes an explicit OpenSSL version into the integration-test xtask when running full precheck.
xtask/src/openssl_install.rs	Generalizes OpenSSL auto-install to accept a version string and parameterizes install/cache paths.
xtask/src/integration_tests.rs	Adds --openssl-version CLI flag and wires it into OpenSSL resolution for integration tests.
xtask/README.md	Documents the new integration-tests command and --openssl-version usage.
plugins/ossl_prov/integration-tests/openssl-cli/testfiles/env.sh	Adds shell helpers to skip tests when OpenSSL is below a required version.
plugins/ossl_prov/integration-tests/openssl-capi/cpp/openssl_capi_integration_tests.rs	Ensures OpenSSL subprocesses use the correct OpenSSL shared libs by setting LD_LIBRARY_PATH.
plugins/ossl_prov/README.md	Documents supported OpenSSL versions and adds a comprehensive integration testing guide.
.github/workflows/rust.yml	Adds OpenSSL version matrix for provider integration testing and wires env vars for each version.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[Copilot]

This duplicates the default OpenSSL version already declared on the IntegrationTest CLI struct (default_value = \"3.0.3\"). To avoid drift if the default changes later, prefer constructing via a shared constant/default (e.g., a DEFAULT_OPENSSL_VERSION constant or impl Default for IntegrationTest).

Suggested change

	integration_tests::IntegrationTest {
	openssl_version: "3.0.3".to_string(),
	}
	.run(ctx.clone())?;
	integration_tests::IntegrationTest::parse_from(["integration-test"])
	.run(ctx.clone())?;