fix(aix): bump openssl to 3.5.6 to match deps/repos.MODULE.bazel (#50022)

### What does this PR do?
Bumps `OPENSSL_VERSION` in `packaging/aix/stages/01-native-libs.sh` from `3.5.5` to `3.5.6` so the AIX native-libs build agrees with every other openssl pin in the repo.

### Motivation
Recent audit surfaced that openssl is pinned in 5 places across the repo, with one source of drift:

| File | Line | Version | Status |
|---|---|---|---|
| `deps/repos.MODULE.bazel` | 120 | 3.5.6 | ✅ |
| `deps/openssl/version.bzl` | 1 | 3.5.6 | ✅ |
| `omnibus/config/software/openssl3.rb` | 21 | 3.5.6 | ✅ |
| `packaging/aix/stages/01-native-libs.sh` | 67 | **3.5.5** | ❌ drift |
| `tasks/msi.py` | 96 | "3.5" (major.minor) | ✅ — intentional |

The AIX file's own header (line 60) explicitly declares `# Source of truth: deps/repos.MODULE.bazel`, so the lag is unambiguously a missed sync, not an intentional pin.

`tasks/msi.py:96` is left alone: `"3.5"` is the OpenSSL Windows registry-key segment (per `https://github.com/openssl/openssl/blob/master/NOTES-WINDOWS.md#installation-directories`) and is intentionally major.minor only — bumping to `"3.5.6"` would be wrong. The `3.5.x` line is still correct for openssl 3.5.6.

This drift cleanup is also a precondition for adding Renovate tracking to the openssl dep (PR-A in the upcoming Bazel-native-deps batch). Renovate would otherwise see two distinct openssl versions in the repo and open conflicting PRs on every bump.

### Describe how you validated your changes
- `git grep -nF 'openssl' packaging/aix/stages/01-native-libs.sh` confirms all references use the `$OPENSSL_VERSION` variable; no hardcoded `3.5.5` strings remain.
- The AIX script downloads from `github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz` (with `openssl.org/source` as fallback). Both URLs serve a valid 3.5.6 tarball today.
- The script does NOT pin a sha256 — it trusts the upstream source. So no hash refresh is needed.

### Additional Notes
- Same file also contains a **separate libxslt drift the other direction** (line 70: `LIBXSLT_VERSION="1.1.45"` while `deps/repos.MODULE.bazel:347` is at `1.1.43`). Out of scope for this PR — flagged for owner of the AIX build pipeline to triage.
- Companion to #50005 (Renovate coverage check). Both ship before the upcoming Renovate-tracking PRs.

Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>

Author: chouetz

packaging/aix/stages/01-native-libs.sh

@@ -64,7 +64,7 @@ mkdir -p "$EMBEDDED_DESTDIR/share"
 #
 ZLIB_VERSION="1.3.1"
 BZIP2_VERSION="1.0.8"
-OPENSSL_VERSION="3.5.5"
+OPENSSL_VERSION="3.5.6"
 XZ_VERSION="5.8.1"
 LIBXML2_VERSION="2.14.5"    # built from source (AIX Toolbox also available but we build)
 LIBXSLT_VERSION="1.1.45"   # from AIX Toolbox (yum install libxslt-devel; source build fails on AIX)
@@ -262,6 +262,9 @@ else
     rm -rf "$BUILD_DIR/build/openssl-${OPENSSL_VERSION}"
     extract_gz "$TARBALL" "$BUILD_DIR/build"
     cd "$BUILD_DIR/build/openssl-${OPENSSL_VERSION}"
+    # Apply OpenSSL 3.5.6 regression fix (matches deps/repos.MODULE.bazel).
+    # Upstream issue: openssl/openssl#30728 — OSSL_PARAM_BLD_push_octet_*() with buf=NULL, bsize=0 fails.
+    patch -p1 < "$SCRIPT_DIR/../../../deps/openssl/0002-OSSL_PARAM_BLD_push_octet_allow_NULL_buffer.patch"
     ./Configure aix64-gcc \
         --prefix="$EMBEDDED" \
         --openssldir="$EMBEDDED/ssl" \