Bump BoringSSL submodule to 4a3cda40b (API version 40)

Update the BoringSSL submodule from 91a66a59b (API version 37) to
4a3cda40b965bbda7cebf86e35c1ed6890ebcc34 (API version 40).

This moves the BoringSSL dependency forward by 653 commits. Key
addition in this range: ML-DSA support in libssl.

Changes:
- Update boring-pq.patch context for new BoringSSL.
- Remove rpk.patch: RPK is now native to BoringSSL. Update Rust
  bindings to use upstream API names (SSL_get0_peer_rpk,
  SSL_CTX_set1_accepted_peer_cert_types, SSL_get_peer_cert_type,
  TLSEXT_cert_type_*). SSL_CREDENTIAL_new_raw_public_key now takes
  EVP_PKEY* directly.

Author: johnhurt

boring-sys/Cargo.toml

@@ -33,6 +33,8 @@ include = [
     "/deps/boringssl/crypto/err/*.errordata",
     "/deps/boringssl/**/*.bzl",
     "/deps/boringssl/**/*.cc",
+    "/deps/boringssl/**/*.cpp",
+    "/deps/boringssl/**/*.in",
     "/deps/boringssl/**/CMakeLists.txt",
     "/deps/boringssl/**/sources.cmake",
     "/deps/boringssl/**/util/go_tests.txt",

boring-sys/build/config.rs

@@ -107,7 +107,7 @@ impl Config {
             );
         }
 
-        let features_with_patches_enabled = self.features.rpk || self.features.underscore_wildcards;
+        let features_with_patches_enabled = self.features.underscore_wildcards;
 
         let patches_required = features_with_patches_enabled && !self.env.assume_patched;
 

boring-sys/build/main.rs

@@ -443,13 +443,10 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
             native BoringSSL is expected to have the patches included"
         );
         return Ok(());
-    } else if config.env.source_path.is_some()
-        && (config.features.rpk || config.features.underscore_wildcards)
-    {
+    } else if config.env.source_path.is_some() && config.features.underscore_wildcards {
         panic!(
             "BORING_BSSL_ASSUME_PATCHED must be set when setting
-               BORING_BSSL_SOURCE_PATH and using any of the following
-               features: rpk, underscore-wildcards"
+               BORING_BSSL_SOURCE_PATH and using the underscore-wildcards feature"
         );
     }
 
@@ -467,10 +464,7 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
     println!("cargo:warning=applying post quantum crypto patch to boringssl");
     apply_patch(config, "boring-pq.patch")?;
 
-    if config.features.rpk {
-        println!("cargo:warning=applying RPK patch to boringssl");
-        apply_patch(config, "rpk.patch")?;
-    }
+    // RPK support is now native to BoringSSL; no patch needed.
 
     if config.features.underscore_wildcards {
         println!("cargo:warning=applying underscore wildcards patch to boringssl");