**Summary**
Add configuration mode CLI to enable FIPS-compatible OpenSSL modules.
Proposed CLI:
```
set system option fips
```
In the backend, it should install FIPS modules:
```
sudo openssl fipsinstall \
-module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so \
-out /usr/lib/ssl/fipsmodule.cnf
```
It should render OpenSSL config:
```
vyos@r14:~$ sudo sed -i 's|^# \[default_sect\]|[default_sect]\nactivate = 1|' /etc/ssl/openssl.cnf
vyos@r14:~$ grep -n "default_sect" /etc/ssl/openssl.cnf
58:default = default_sect
71:[default_sect]
vyos@r14:~$
vyos@r14:~$
vyos@r14:~$ openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.1.2
status: active
fips
name: OpenSSL FIPS Provider
version: 3.1.2
status: active
vyos@r14:~$
```
It MUST disable the `default` providers. Implementation relies on the T8508
For simple tests:
```
# Must work (FIPS-approved)
echo test | openssl dgst -sha256
# Must FAIL (non-FIPS)
echo test | openssl dgst -md5
# Must FAIL (non-FIPS)
openssl enc -des3 -k test -in /dev/null
# Check available ciphers — no CHACHA, no RC4, no DES
openssl list -cipher-algorithms | grep -iE "chacha|rc4|des|md5"
```