workflows: add build-cryptography.yml for riscv64 wheels - #362

The upstream `container:` job can't be reused as-is: their custom
ghcr.io/pyca/cryptography-manylinux2014-style images (Rust + a static
OpenSSL build preinstalled) don't exist for riscv64, and the generic
quay.io/pypa/manylinux_2_39_riscv64 image ships no Node, so a native
`container:` job can't run the checkout/artifact actions inside it.
Drive it with `podman run` instead (same pattern as build-orjson.yml),
keeping the actions on the host and running upstream's own build
commands inside - only dropping OPENSSL_STATIC/OPENSSL_DIR/
--sbom-include (no static OpenSSL or SBOM to point at; openssl-sys
finds the image's dynamic system OpenSSL via pkg-config instead) and
installing Rust/openssl-devel ourselves.

Split the real pytest suite into its own `test` job (upstream's
wheel-builder.yml only smoketests; the full suite lives in a separate
ci.yml matrix out of scope here) using cryptography_vectors straight
from public PyPI instead of building it from vectors/.

We need to allow SHA1 in the test job's OpenSSL config, otherwise the
manylinux image's system openssl.cnf rejects SHA1 signing/verification
by default, causing 11 test failures. It isn't bundled by auditwheel, so
it never reaches the shipped wheel - only this in-container test run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>