What were you trying to do that didn't work?

This is an OpenSSL-related issue

Having a FIPS host with the DEFAULT policy is not using the provided groups at all, and the reason is that in the policy groups, we have X448 (an algorithm not recognizable by FIPS openssl), so the whole config line is thrown away. 

We can fix that by adding '?' before this algorithm (and every other, for what matters) so to use it only if it is available.

What is the impact of this issue to you?

low

Please provide the package NVR for which the bug is seen:

crypto-policies-20251127-1.git27c2902.el10

How reproducible is this bug?:

always

Steps to reproduce

1. Have a FIPS host
2. Change crypto-policy to DEFAULT
3. Connect to a HybridPQ-only server

Expected results

Connection succeeds since Hybrid PQ algorithms are in the policy groups

Actual results

Connections fail with 'no common key shares found' error