Fix SSLv3 detection with AWS-LC

[goatgoose]

Description of changes:

Currently when s2n-tls is in FIPS mode, the SSLv3 HMAC algorithms are disabled. This prevents SSLv3 from being used in FIPS mode, which is a valid use case for customers using the same FIPS build of s2n-tls for FIPS and non-FIPS endpoints.

Note that restricting SSLv3 for FIPS-compliance is unrelated to this issue, and determined by selecting a FIPS-compatible s2n-tls security policy, not by the MD5/SSLv3 runtime checks. This change does not impact the s2n-tls FIPS-compatible security policies, which are not able to negotiate SSLv3.

The runtime check exists due to how the FIPS build of OpenSSL behaves. By default, OpenSSL disables MD5 at runtime when FIPS mode is enabled, which is required for SSLv3. This causes EVP_DigestInit calls to fail, unless md5 is explicitly enabled. s2n_hmac_is_available() isn't actually necessary to disable SSLv3 with OpenSSL-FIPS since attempting to use md5 later will fail, but it is used in tests to determine if the tests should be run or not.

This PR updates s2n_hmac_is_available() to indicate that the SSLv3 HMAC algorithms are available with AWS-LC, since AWS-LC-FIPS doesn't disable any functionality in FIPS mode. This allows SSLv3 to be negotiated with non-FIPS security policies that allow SSLv3.

Call-outs:

Adding an exception for AWS-LC essentially means we're bypassing the need to explicitly enable MD5 for the SSLv3 PRF when linked with AWS-LC. An alternative solution for this would be to just remove all of the logic for enabling/checking the status of MD5 and have it always be enabled on hash init. This would make OpenSSL-FIPs behave like AWS-LC-FIPS where MD5 functionality is always available, and we wouldn't need separate logic for OpenSSL and AWS-LC. This is a much bigger change, though.

I used cbmc/stubs/s2n_is_in_fips_mode.c as a reference for writing the s2n_libcrypto_is_awslc stub.

Testing:

I added a new self-talk unit test for SSLv3 which runs with AWS-LC-FIPS.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[goatgoose]

This change can be tested in the integration tests now that @maddeleine added SSLv3 support in #4372. I updated the tests to not skip SSLv3 in FIPS mode with AWS-LC.

This can be confirmed by observing the SSLv3 tests that run in the AWS-LC-FIPS/AWS-LC-FIPS 2022 happy path jobs.