Add EVP_PKEY KEM operations

[bdewater-thatch]

I was poking around net-ssh to add support for OpenSSH’s post-quantum hybrid key exchange mlkem768x25519-sha256, but for that to work it needs access to these APIs because it uses ML-KEM-768 directly (not HPKE).

OpenSSL docs:

• https://docs.openssl.org/master/man3/EVP_PKEY_encapsulate/
• https://docs.openssl.org/master/man3/EVP_PKEY_decapsulate/

[rhenium]

Thanks for working on this! It looks good to me overall, with a few minor comments below.

[bdewater-thatch]

Thanks for the feedback @rhenium, I implemented your suggestions.

[rhenium]

Looks good to me, thanks!