Prepare AWS-LC v1.61.0

[justsmth]

Description of changes:

Prepare AWS-LC v1.61.0.

Changes

• Apply additional X509 validation checks on certificates sourced from trust store by @skmcgrail in Apply additional X509 validation checks on certificates sourced from trust store  #2230
• Reorganizing compatability tests, rework certificates for better groking by @skmcgrail in Reorganizing compatability tests, rework certificates for better groking #2305
• Additional X.509 Behavior Compatability Tests by @skmcgrail in Additional X.509 Behavior Compatability Tests #2312
• Merge main into x509 by @skmcgrail in Merge main into x509 #2351
• Add Support for IPv4 and IPv6 X.509 Certificate Name Constraints by @skmcgrail in Add Support for IPv4 and IPv6 X.509 Certificate Name Constraints #2340
• Merge main to x509 by @skmcgrail in Merge main to x509 #2390
• Reintroduce support for validating DNS commonName subjects when name constraints are present. by @skmcgrail in Reintroduce support for validating DNS commonName subjects when name constraints are present. #2376
• Support client-side hostname checks with leading . by @skmcgrail in Support client-side hostname checks with leading . #2403
• Verify leaf certificate public key rather then leaving it to the caller by @skmcgrail in Verify leaf certificate public key rather then leaving it to the caller #2438
• Merge main into x509 by @skmcgrail in Merge main into x509 #2613
• Support for explicit curve parameter on EC public keys where parameters match supported curves by @skmcgrail in Support for explicit curve parameter on EC public keys where parameters match supported curves #2642
• Add x86 Keccak implementation by @manastasova in Add x86 Keccak implementation #2619
• Gate EC explicit curve parameters for X.509 behind flag by @skmcgrail in Gate EC explicit curve parameters for X.509 behind flag #2648
• Update CPU Jitter Entropy dependency to version 3.6.3 by @torben-hansen in Update CPU Jitter Entropy dependency to version 3.6.3 #2654
• Fix benchmarking issues with FIPS main by @samuel40791765 in Fix benchmarking issues with FIPS main #2655
• Add standalone MLKEM supported groups by @alexw91 in Add standalone MLKEM supported groups #2589
• Merge main into x509 by @skmcgrail in Merge main into x509 #2657
• Document and statically assert counters can't overflow by @torben-hansen in Document and statically assert counters can't overflow #2658
• TLS Transfer Serialization Improvements by @skmcgrail in TLS Transfer Serialization Improvements #2616
• Fix ternary operator in github workflow by @torben-hansen in Fix ternary operator in github workflow #2653
• Merge x509 branch into main by @skmcgrail in Merge x509 branch into main #2660
• Address clang-ci comments on new x509 code by @skmcgrail in Address clang-ci comments on new x509 code #2662
• Implement snapsafe fallback entropy source by @torben-hansen in Implement snapsafe fallback entropy source #2651
• Rand small fixes by @torben-hansen in Rand small fixes #2664
• Import s2n-bignum 2025-09-05-04 by @dkostic in Import s2n-bignum 2025-09-05-04 #2667
• Refactor iOS CI script by @justsmth in Refactor iOS CI script #2637
• Re-import mlkem-native for addition of CFI directives by @hanno-becker in Re-import mlkem-native for addition of CFI directives #2659
• Fix typo in ssl_transfer_asn1 by @samuel40791765 in Fix typo in ssl_transfer_asn1 #2665
• Fix for zig build by @justsmth in Fix for zig build #2668
• Update SSLProxy patch by @skmcgrail in Update SSLProxy patch #2663
• ML-DSA service indicator by @jakemas in ML-DSA service indicator #2666
• Add aes-xts AArch64 implementation that will eventually be imported from s2n-bignum. by @nebeid in Add aes-xts AArch64 implementation that will eventually be imported from s2n-bignum. #2632
• Fix Keccak MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX flag by @manastasova in Fix Keccak MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX flag #2670
• Increase SSLBuffer size to INT_MAX by @samuel40791765 in Increase SSLBuffer size to INT_MAX #2673
• Wrap compiler when FIPS w/ clang v20+ by @justsmth in Wrap compiler when FIPS w/ clang v20+ #2671
• Test ACCP in FIPS mode as well as non-FIPS by @WillChilds-Klein in Test ACCP in FIPS mode as well as non-FIPS #2669
• fix: Allow zero-length passwords in PEM key decryption by @kingstjo in fix: Allow zero-length passwords in PEM key decryption #2677

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.82%. Comparing base (5f1d0d2) to head (54a9cac).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2681      +/-   ##
==========================================
- Coverage   78.83%   78.82%   -0.01%     
==========================================
  Files         667      667              
  Lines      114077   114077              
  Branches    16046    16045       -1     
==========================================
- Hits        89935    89926       -9     
- Misses      23365    23378      +13     
+ Partials      777      773       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.