chore(deps): bump boringssl to upstream main@594a4429 (2026-10-18)

[gg582]

What

Bumps the vendored lib/boringssl submodule:

• old: ebd832c3924065de594ffda62b376aeb2e4f61a9 (2026-09-11)
• new: 594a44291086dcc7cef06cabec4c0b47afd674c0 (2026-10-18), current HEAD of upstream google/boringssl main

85 upstream commits. Notable changes include:

• EVP gains SHA3-256/384/512
• X509 verification internals reworked (internal_verify rewrite, CRL handling cleanup)
• const-correctness sweeps across mem, x509v3, and friends
• Merkle Tree Certificates (MTC) draft updates
• Removed deprecated split-handshake support and X509_STORE_CTX_get0_current_crl (CWIST uses neither)

No CWIST source changes were needed — only the gitlink moves.

Verification (local)

In a clean worktree based on origin/dev, with lib/boringssl checked out at the new commit, lib/lsquic checked out at its pinned commit 5b7dc8f and rebuilt against the new BoringSSL, and the other submodules linked from prebuilt copies:

make test_https   # builds libssl.a/libcrypto.a, rebuilds lsquic, builds libcwist.a, links and runs ./test_https

Result: exit code 0, all tests passed:

Testing HTTPS defaults...
Passed HTTPS defaults.
Testing HTTPS ALPN negotiation and HTTP/1.1 fallback...
Passed HTTPS ALPN negotiation and HTTP/1.1 fallback.
Testing HTTPS/2 toggle context rebuild...
Passed HTTPS/2 toggle context rebuild.
Testing HTTPS AIA intermediate autoload...
Passed HTTPS AIA intermediate autoload.
Testing HTTPS async defer and keep-alive...
Passed HTTPS async defer and keep-alive.
Testing HTTPS async defer completed before dispatch ack...
Passed HTTPS async defer completed before dispatch ack.
All HTTPS tests passed!

Full CI runs on this PR.