[release/9.0-staging] Do not set the salt or info if they are NULL for OpenSSL HKDF.

[github-actions]

Backport of #114864 to release/9.0-staging

/cc @vcsjones

Customer Impact

• Customer reported
• Found internally

This issue was found internally by scouting a nightly build of OpenSSL 3.5.1-dev. Customers that use the HKDF.Expand on Linux with OpenSSL 3.0 or greater will unconditionally receive an exception:

Error Message:
   Interop+Crypto+OpenSslCryptographicException : error:078C0102:common libcrypto routines::passed a null parameter
  Stack Trace:
     at Interop.Crypto.HkdfExpand(SafeEvpKdfHandle kdf, ReadOnlySpan`1 prk, String algorithm, ReadOnlySpan`1 info, Span`1 destination) in /__w/runtime-ci/runtime-ci/runtime/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EVP.Kdf.cs:line 113
   at System.Security.Cryptography.HKDF.Expand(HashAlgorithmName hashAlgorithmName, Int32 hashLength, ReadOnlySpan`1 prk, Span`1 output, ReadOnlySpan`1 info) in /__w/runtime-ci/runtime-ci/runtime/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HKDF.OpenSsl.cs:line 44

This is due to setting the salt parameter to NULL, where OpenSSL wants the set to be omitted entirely when there is no salt value. Customers have no means to work around this.

Regression

• Yes
• No
• Upstream

This regressed due to an upstream change in OpenSSL at openssl/openssl#27305, which is cherry-picked for all OpenSSL 3.x releases.

Testing

Existing tests caught the issue when running against OpenSSL 3.5.1-dev. With the changes, the tests are back to green.

Risk

Low. The change is to not set the salt and info parameters if they are NULL, instead of setting them to NULL values. The functionality has strong test coverage and existing tests verify the change is correct.

IMPORTANT: If this backport is for a servicing release, please verify that:

• The PR target branch is release/X.0-staging, not release/X.0.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

/ba-g this error looks like #108078, and is not in any area that would have been impacted by this change.