Debian's bookworm-security OpenSSL 3.0.22-1~deb12u2 (DLA-4859-1) carries several security fixes, including backports from 3.0.23. VyOS still ships 3.0.20-1~deb12u2+vyos1.

Since T9040/T9083 VyOS builds its own OpenSSL (FIPS provider enabled, +vyos1 suffix) from a higher-priority repo, so Debian's security updates no longer reach the image on their own.

Bump scripts/package-build/openssl/package.toml from debian/openssl-3.0.20-1_deb12u2 to debian/openssl-3.0.22-1_deb12u2. The FIPS patch still applies unchanged and the +vyos1 suffix stays.