[microsoft/release-branch.go1.26] support OpenSSL 3.5.6

[qmuntal]

For #2221

[Copilot]

Pull request overview

Updates the vendored github.com/golang-fips/openssl/v2 dependency to address OpenSSL 3.5.6 behavior changes (notably NULL-buffer rejection in OSSL_PARAM_BLD_push_octet_string) for GOEXPERIMENT=systemcrypto scenarios.

Changes:

• Bumps the vendored github.com/golang-fips/openssl/v2 pseudo-version in src/go.mod/src/vendor/modules.txt (within the vendor patch).
• Introduces a “never-empty” pointer helper (pbaseNeverEmpty) and updates parameter building to avoid passing NULL for zero-length octet strings.
• Adjusts HKDF/TLS13-KDF parameter construction to call addOctetString more consistently (removing some length guards).

Show a summary per file

File	Description
patches/0001-Vendor-external-dependencies.patch	Updates the vendored OpenSSL bindings and module metadata to avoid OpenSSL 3.5.6 NULL octet-string parameter failures.

Copilot's findings

Comments suppressed due to low confidence (1)

patches/0001-Vendor-external-dependencies.patch:20712

• addOctetString currently returns early for nil slices, which treats nil as “parameter absent”. In Go, nil slices are commonly used to represent an empty value (especially for TLS 1.3 HKDF context), so this can inadvertently omit required/meaningful parameters and potentially change derived outputs. Consider normalizing nil to a zero-length value (so it still gets passed with len==0 via pbaseNeverEmpty) and only omitting parameters at the call sites that are truly optional.

• Files reviewed: 1/1 changed files
• Comments generated: 1