Update from upstream (fips-mode-setup, sntrup761x25519):
- fips-mode-setup: improve handling FIPS plus subpolicies
- fips-mode-setup: catch more inconsistencies, clarify --check
- fips-mode-setup, fips-finish-install: abandon /etc/system-fips
- openssh: add support for sntrup761x25519-sha512@openssh.com