RFC: crypto: Rework backend selection to be more strict

[smalis-msft]

With this PR I'm trying to thread the needle between two slightly contradictory goals:

• A shipping binary should have a strong guarantee that it has linked in the crypto backend it expects
• Developers should have minimal friction when performing workspace-wide operations, despite binaries asking for disparate crypto backends

To accomplish this I've come up with the following protocol:

• Remove the "no features" default fallback. A binary must pick a crypto backend. This is a lot simpler now that way fewer crates depend on crypto, thanks to other refactors. Add a new 'native' feature to represent the previous implicit default.
• A new feature, 'allow-multiple-backends', is added as an escape hatch for things like CI and rust-analyzer. A rust-analyzer.toml file at the repo root ensures this feature is always enabled for developers.
• crypto's build script will enforce that either a single backend is chosen, or allow-multiple-backends is enabled.
• A new crate, 'crypto_allow_multiple_backends', is added to the workspace. This crate does nothing but enable the 'allow-multiple-backends' feature. This exists so that commands like cargo build --workspace can still succeed. Nothing depends on this crate, and nothing ever should.

I'm hoping that this flow will allow all common developer commands to continue working, while ensuring that we don't accidentally produce an insecure binary.

[Copilot]

Pull request overview

This PR tightens support/crypto backend selection so builds explicitly choose a crypto backend, while introducing an escape hatch to keep workspace-wide developer/CI workflows workable.

Changes:

• Added crypto/native and crypto/allow-multiple-backends features, and reworked support/crypto/build.rs to enforce explicit backend selection (with a warning-based fallback when multiple backends are allowed).
• Updated select crates to explicitly choose backends (e.g., openvmm_entry uses native, UEFI fuzz uses rust) and adjusted VMGS-related crates to include backend + vendoring features.
• Updated Flowey/CI configuration to account for the stricter backend selection and renamed CI test labels from “none” to “native”; added rust-analyzer.toml to enable the multi-backend escape hatch for analysis.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
xtask/src/tasks/fuzz/html_coverage.rs	Tweaks coverage filtering for fuzz HTML report generation.
vm/vmgs/vmgstool/Cargo.toml	Makes encryption feature select a crypto backend (native) and vendoring.
vm/vmgs/vmgs_lib/Cargo.toml	Pins crypto dependency to native + vendored.
vm/devices/firmware/firmware_uefi/fuzz/Cargo.toml	Switches fuzz target to the crypto/rust backend.
support/crypto/Cargo.toml	Adds allow-multiple-backends and native features; clarifies Linux “native” backend note.
support/crypto/build.rs	Implements strict backend selection logic and new escape hatch behavior.
rust-analyzer.toml	Ensures rust-analyzer enables crypto/allow-multiple-backends for workspace analysis.
openvmm/openvmm_entry/Cargo.toml	Forces openvmm_entry to select the native crypto backend; updates unused-deps note.
flowey/flowey_lib_hvlite/src/build_nextest_unit_tests.rs	Adjusts nextest feature sets to accommodate stricter crypto backend selection.
flowey/flowey_lib_hvlite/src/_jobs/check_clippy.rs	Adjusts clippy feature sets and removes special-case exclusion of crypto.
ci-flowey/openvmm-pr.yaml	Updates pipeline labeling from crypto “none” to “native”.
.github/workflows/openvmm-pr.yaml	Regenerated workflow reflecting updated crypto test labeling.
.github/workflows/openvmm-pr-release.yaml	Regenerated workflow reflecting updated crypto test labeling.
.github/workflows/openvmm-ci.yaml	Regenerated workflow reflecting updated crypto test labeling.

[smalis-msft]

Yeah I know, thinking about this.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

[github-actions]

1 Petri tests failed (1 unstable)

[github-actions]

1 Petri tests failed (1 unstable)

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 4 comments.

[github-actions]

2 Petri tests failed (2 unstable)

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 3 comments.