chore(deps): update dependency libressl/portable to v4.1.0 (master)

[openvpn-inc-ci]

This PR contains the following updates:

Package	Update	Change
libressl/portable	minor	v4.0.0 -> v4.1.0

---

Release Notes

libressl/portable (libressl/portable)

v4.1.0

Compare Source

Portable changes

• Added initial experimental support for loongarch64.
• Fixed compilation for mips32 and reenable CI.
• Fixed CMake builds on FreeBSD.
• Fixed the --prefix option for cmake --install.
• Fixed tests for MinGW due to missing sh(1).

Internal improvements

• Cleaned up the error implementation.
• Many bug fixes and simplifications in the EC ASN.1 code.
• Corrected DER encoding for EC keys and parameters.
• Polished EC_POINT_{oct2point,point2oct}() internals.
• Rewrote the wNAF code for fast ECDSA verification.
• Improved the code setting compressed coordinates for EC points.
• Reworked CPU capabilities detection for amd64 and aarch64.
• New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64.
  These make use of the SHA-NI instruction if it is available and
  replace the perl-generated assembly optimized for museum pieces.
  These are not yet enabled in libressl-portable.
• New SHA-256 and SHA-512 assembly implementations for aarch64
  making use of the ARM Cryptographic Extension (CE). Not yet
  enabled in libressl-portable.
• New simplified, readable MD5 implementation for amd64.
• Rewrote BN_bn2binpad() and its lebin siblings.
• The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated.
• Rewrote TS_ASN1_INTEGER_print_bio().
• Improved bit counter handling in MD5.
• Simplified and cleaned up the BN_RECP_CTX internals.
• Improved SM4 to match other symmetric ciphers more closely.
• Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB.
• CRLs are now cached in the issuer cache like certificates.
• Replaced combinations of BN_MONT_CTX_new/set with an internal
  BN_MONT_CTX_create().
• Replaced BN_bn2hex() reimplementation in openssl(1) ca with
  a proper API call.
• Fixed integer overflows due to signed shift in obj_dat.c.
• Improved some X509_VERIFY_PARAM internals and avoid an out of
  bounds read from public API.
• Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).

Compatibility changes

• Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto().
  It has no effect since LibreSSL doesn't call atexit().
• Elliptic curve parameters are only accepted if they encode a
  built-in curve.
• EC_METHOD is no longer public and the API exposing it has been
  removed. This includes EC_GROUP_new(), EC_GFp_mont_method(),
  EC_GROUP_method_of() and EC_METHOD_get_field_type().
• The precomputation stubs for EC_GROUP were removed.
• The API setting Jacobian projective coordinates for a point was
  removed as were EC_POINTs_{mul,make_affine}().
• All elliptic curves over fields with less than 224 bits and a
  few more were removed from the built-in curves. This includes
  all WTLS curves and P-192.
• It is no longer necessary to set RSA_FLAG_SIGN_VER to use the
  sign and verify handlers set with RSA_meth_set_{sign,verify}.
• Removed the -C option to generate "C code" from the openssl(1)
  dh, dhparam, dsaparam, ecparam, and x509 subcommands.
• Removed #error in headers when OPENSSL_NO_* is defined.
• CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and
  CRYPTO_set_mem_ex_functions() was removed.
• The tls_session_secret_cb_fn type now matches OpenSSL 1.1.
• Unexport X509_NAME_print() and X509_OBJECT_up_ref_count().
• const corrected UI_OpenSSL() and BN_MONT_CTX_copy().
• Support OPENSSL_NO_FILENAMES.
• Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.
• Export PKCS12_key_gen_uni() again.

New features

• libtls has a new tls_peer_cert_common_name() API call to retrieve
  the peer's common name without having to inspect the PEM.

Bug fixes

• Plugged a leak in eckey_compute_pubkey().
• Again allow the magic values -1, -2 and -3 for the salt length
  of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface.
• Fixed a few memory leaks in legacy code.

Documentation

• The remaining undocumented public EVP API is now documented.
• Reorganization of existing documentation for clarity and accuracy.

Testing and proactive security

• Improved regress coverage of the EC code.

The LibreSSL project continues improvement of the codebase to reflect modern, safe programming practices. We welcome feedback and improvements from the broader community. Thanks to all of the contributors who helped make this release possible.

Full release notes: https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.0-relnotes.txt
Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.