Provide a runtime FIPS-restricted CryptoProvider in rustls' aws-lc-rs

Checklist

• I've searched the issue tracker for similar requests

Is your feature request related to a problem? Please describe. To get a FIPS-restricted CryptoProvider at runtime (without the fips compile-time feature), consumers must manually filter cipher_suites and kx_groups from default_provider(). This requires each consumer to know which algorithms are FIPS-approved, keep that list in sync with upstream changes, and handle edge cases.

Additionally, the HPKE suite list (ALL_SUPPORTED_SUITES) is gated by #[cfg(not(feature = "fips"))] and is not part of the CryptoProvider struct. There is no way to filter HPKE suites at runtime. They are either compiled in or not. This means full FIPS parity with the compile-time feature is not achievable at runtime today.

Describe the solution you'd like

1. Provide a function (e.g., fips_provider()) that returns a FIPS-restricted CryptoProvider at runtime without requiring the fips Cargo feature on rustls. Linking against aws-lc-fips-sys (via aws-lc-rs/fips) is the only compile-time requirement for FIPS. It provides the validated crypto module. All other FIPS behavior (cipher suite filtering, kx group filtering, EMS enforcement) is rustls-level policy that should be applicable at runtime.

2. Make HPKE suites runtime-configurable. Either as a field on CryptoProvider or via a separate runtime accessible list so consumers can achieve full FIPS restriction without compile-time feature flags.

Additional context rustls::crypto::default_fips_provider() exists but only compiles when the fips feature is enabled. Consumers building a single binary that detects FIPS mode at runtime (e.g., reading /proc/sys/crypto/fips_enabled at startup) cannot use it without also enabling compile-time filtering for all builds.