Harden TLS handshake validation, OpenSSL-compat defaults, and stale code paths #6443

Job	Run time
build library (--enable-intelasm --enable-sp-asm --enable-mlkem --enable-lms --enable-xmss --enab...	33s
build library (--disable-asm --enable-all-crypto --enable-mlkem --enable-lms --enable-xmss --enab...	50s
build library (--enable-intelasm --enable-sp-asm)	34s
build library (--enable-intelasm --enable-sp-asm --enable-all-crypto --enable-mlkem --enable-lms ...	48s
build library (--disable-asm --enable-mlkem --enable-lms --enable-xmss --enable-mldsa)	32s
build library (--disable-asm)	38s
	3m 55s

Provide feedback