Ensure builtin hashlib implementations honor usedforsecurity=True when _hashlib is in FIPS mode

Feature or enhancement

Proposal:

When OpenSSL is not available, or is not in FIPS mode:

• no change of behaviour

When OpenSSL is available and is in FIPS mode:

• ensure that only OpenSSL implementations are used when usedforsecurity=True
• ensure that all built-in (fallback) implementations require usedforsecurity=False

This addresses all needs of FIPS users that expect approved only cryptography from hashlib by default.
It satisfies Python guarantees of always available algorithms, as built-in fallbacks remain accessible with an explicit consent from the user that unapproved (an FIPS/ISO term) implementation is acceptable to the user.

In FIPS mode it means that all users can gain access to blake2/shake/md5, even when these algorithms are either blocked or unavailable from the runtime OpenSSL in FIPS mode. As long as usedforsecurity=False is used.

This also removes need to recompile or configure python somehow different for a non-fips & fips build, specifically one can safely compile python with all with-builtin-hashlib-hashes enabled.

Diagrams and full details of the current state of hashlib; and FIPS user desires are documented in this issue is opened as a reference for potential implementations to resolve all needs and desires listed there.

This issue will be used as a reference for potential implementations.

Has this already been discussed elsewhere?

I have already discussed this feature proposal on Discourse

Links to previous discussion of this feature:

Discuss:

• https://discuss.python.org/t/python-and-openssl-fips-mode/51389/12

(note there are some off-topic messages there)

Linked PRs

• gh-127301
• gh-127492

Bắt đầu bằng cách xem xét các PR được liên kết gh-127301 và gh-127492, sau đó đọc cuộc thảo luận trên Discourse được liên kết trong issue để hiểu bối cảnh. So sánh hành vi hashlib được yêu cầu trong và ngoài chế độ OpenSSL FIPS; được coi là hoàn tất khi các triển khai OpenSSL được sử dụng cho usedforsecurity=True và các triển khai fallback yêu cầu usedforsecurity=False trong chế độ FIPS.