Enabling FIPS Provider

[oruff]

Currently, XCA loads the "legacy" provider:
MainWindow::legacy_loaded = OSSL_PROVIDER_try_load(0, "legacy", 1);
Technically, once OpenSSL has been configured to use FIPS mode, one can replace this line by:
MainWindow::legacy_loaded = OSSL_PROVIDER_try_load(NULL, "fips", 1); and it works.

Except that with OpenSSL 3, you also need to specify if you want the FIPS mode on.

One easy way to do this globally:
EVP_set_default_properties(NULL, "fips=yes");

But this instantly breaks XCA when it tries to use MD5 (for I don't know what, yet).

Could we dream of a --fips parameter?