Load wolfProvider at process start and run hostap FIPS tests on approved algorithms only

[aidangarske]

Description

Fixes patch so that FIPS hostap actually uses wolfCrypt through provider layer. When testing WPFF on FIPS hostap tests with non RD we where not failing anyhting now all 9 test suites pass

• The FIPS hostap patch only redirected the lazy TLS-path provider load, so in non-replace-default mode OpenSSL 3 kept using its stock default provider for the PSK/SAE paths (which never call tls_init) and crypto silently bypassed wolfProvider.
• Adds a constructor in src/crypto/crypto_openssl.c that loads libwolfprov at process start with retain_fallbacks=0, so every crypto path routes through wolfProvider from the first call; keeps the existing legacy->libwolfprov provider redirect.
• Points hostapd.py wpa2_eap_params at the integrated EAP server (with PAC params for EAP-FAST) so FIPS EAP tests authenticate without a RADIUS/MD5 path.
• Drops the hwsim test functions for methods that cannot authenticate under FIPS (MSCHAPv2, LEAP, EAP-MD5, TKIP — MD4/MD5/DES are not FIPS-approved), so the FIPS leg does not false-fail on them.
• inside.sh runs crda with ||true so a missing regulatory agent does not abort the VM boot.
• Testing: hwsim on hostap_2_11, FIPS build. Replace-default 9/9 pass and non-replace-default 9/9 pass across ap_open, discovery, PSK, SAE, EAP-PSK, EAP-TLS, TTLS/GTC, PEAP/GTC, EAP-FAST/GTC; per-process WOLFPROV_FORCE_FAIL on wpa_supplicant drops both to 0 pass, proving crypto genuinely routes through wolfProvider rather than falling back to stock OpenSSL.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.