feat(conf): add DHE-RSA-CHACHA20-POLY1305 cipher to the intermediate configuration

[bungle]

Summary

Mozilla TLS recommendations added DHE-RSA-CHACHA20-POLY1305 cipher to intermediate in their version 5.7, see: https://wiki.mozilla.org/Security/Server_Side_TLS

KAG-3257

Checklist

• The Pull Request has tests
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• [ ] There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

[fffonion]

btw since we are now on OpenSSL 3.x, we can re-add TLSv1.3 and dhparams back for FIPS mode. tls1.3 is allowd per fips-140-3.

also do we want to set ssl_ecdh_curve too? I think the openssl default has included some ciphers that mozilla document doesn't like.

[bungle]

btw since we are now on OpenSSL 3.x, we can re-add TLSv1.3 and dhparams back for FIPS mode. tls1.3 is allowd per fips-140-3.

also do we want to set ssl_ecdh_curve too? I think the openssl default has included some ciphers that mozilla document doesn't like.

Yes, good points. Let’s open separate PRs for them.