Hybrid (PQ) TLS

[eddyashton]

While looking at alternatives to #8076, following @achamayou's proposed design:

I think this is ideally moved to the code, where we detect if we crypto provider support PQC values, and extend the list in that case.

I spotted that [SSL_CTX_set1_curves](https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/) has a ? syntax that handles this detection automagically.

If a group name is prefixed with the ? character, it will be ignored if an implementation is missing. Otherwise, listing an unknown group name will cause a failure to parse the list. Note that whether a group is known or not may depend on the OpenSSL version, how OpenSSL was compiled and/or which providers are loaded. Make sure you have the correct spelling of the group name and when in doubt prefix it with a ? to handle configurations in which it might nevertheless be unknown.

I think this is exactly what we want? And may even resolve #8061? But looking for input from @maxtropets.

[Copilot]

Pull request overview

Updates CCF’s TLS configuration to prefer hybrid post-quantum (PQ) key exchange groups when supported by the linked OpenSSL build, while keeping the current classical ECDHE groups as fallbacks. This aligns with the goal of enabling hybrid secret exchange (per #8061) without hard-failing on OpenSSL builds/providers that don’t recognize PQ group names.

Changes:

• Switch TLS group configuration from SSL_CTX_set1_curves_list to SSL_CTX_set1_groups_list, adding ?-prefixed hybrid PQ group names ahead of existing P-521/P-384/P-256.
• Refactor TLS test handshake logic and add a test asserting that a hybrid PQ group is negotiated when OpenSSL supports them.
• Add a CHANGELOG entry describing the behavior change.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md
• .github/instructions/changelog.instructions.md

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/tls/context.h	Prefer hybrid PQ TLS groups via SSL_CTX_set1_groups_list with ?-prefixed optional group names, retaining classical fallbacks.
src/tls/test/main.cpp	Extract handshake helper and add a test checking negotiation prefers a hybrid PQ group when supported.
CHANGELOG.md	Document the TLS group preference change.

[achamayou]

Not sure about the relative order of 25519 to the NIST curves, but 384hybrid should be before 256hybrid (same as for the EC ones)? If a client supports the stronger/larger variants, we probably want to use those, same as for pure EC.