Fix LibreSSL DH opaque struct access and X448 curve parsing - #5461

Thanks for chasing this down -- I reproduced both problems against LibreSSL 4.3.2 on Ubuntu 26.04 and macOS, and both are real:

• main fails to compile with 8 incomplete type 'DH' errors, because #if !defined(LIBRESSL_VERSION_NUMBER) sends every LibreSSL version down the dh->p path even though DH has been opaque since LibreSSL 2.7.0.
• SSL_CTX_set1_curves_list() returns 0 for any list containing X448 on LibreSSL, so every Context throws. Confirmed with a direct probe.

The DH_free() calls on the NotImplementedException paths and checking the DH_set0_pqg() return value are good catches -- main leaks p and g today because it ignores that return value entirely.

Two structural requests before this goes in.

1. A LibreSSL version macro instead of raw hex. Crypto.h already has POCO_OPENSSL_VERSION_PREREQ and asks callers not to compare OPENSSL_VERSION_NUMBER directly; the same should apply to LibreSSL. LIBRESSL_VERSION_NUMBER uses the same 0xMNNFFPPS encoding, so it is the same shape. Please add to Crypto/include/Poco/Crypto/Crypto.h, next to the existing macro:

#ifndef POCO_LIBRESSL_VERSION_PREREQ
	/// Check for LibreSSL >= major.minor.fix using LIBRESSL_VERSION_NUMBER,
	/// which uses the same 0xMNNFFPPS encoding as OPENSSL_VERSION_NUMBER.
	///
	/// Evaluates to 0 when not building against LibreSSL, so it needs no
	/// #if defined(LIBRESSL_VERSION_NUMBER) guard around it.
	#if defined(LIBRESSL_VERSION_NUMBER)
		#define POCO_LIBRESSL_VERSION_PREREQ(maj, min, fix) \
			(LIBRESSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20) | ((fix) << 12)))
	#else
		#define POCO_LIBRESSL_VERSION_PREREQ(maj, min, fix) 0
	#endif
#endif

2. Drop pre-2.7.0 LibreSSL rather than keeping a legacy branch. LibreSSL 2.7.0 is from 2018, and Poco already requires OpenSSL >= 1.1.1. Setting a minimum the same way, right after the OpenSSL one:

#if defined(LIBRESSL_VERSION_NUMBER) && !POCO_LIBRESSL_VERSION_PREREQ(2, 7, 0)
#error "LibreSSL version too old. At least LibreSSL 2.7.0 is required."
#endif

This is needed as a separate check because LibreSSL hardcodes OPENSSL_VERSION_NUMBER to 0x20000000L for every release, so the existing OpenSSL 1.1.1 gate passes on all LibreSSL versions and can never say anything about which one is in use. Without the LibreSSL minimum, a 2.6 build sails past that gate and then fails deep in Context.cpp with the incomplete type 'DH' errors this PR is fixing.

It also lets the whole #if/#else split in initDH() go away -- the DH_set0_pqg() path becomes unconditional, the last direct struct access leaves the file, and anyone on ancient LibreSSL gets one clear message instead of eight compile errors.

Also, the branch still partly reverts #5460: the merge restored the FIPS block in initDH(), but initECDH() still has its FIPS branch removed, and the merge moved the OPENSSL_NO_DH guard in a way that changes behaviour. Details inline.

Note that #5464 needs to land first: it fixes a mis-nested #else in isFIPSEnabled() that leaves the function with no return on the LibreSSL path. With the above applied on top of #5464, LibreSSL 4.3.2 and OpenSSL 3 both build clean under -Werror=return-type and Crypto, JWT and 65/66 NetSSL tests pass. The one failure is TCPServerTest::testReuseSessionTLS13, a LibreSSL TLS 1.3 session resumption difference unrelated to this PR.

I have also opened #5465, a macOS LibreSSL CI job, so this cannot regress again. It will be merged after this one.

A rebase on main would make this easier to read than the merge commit, but that is up to you.