Move to OpenSSL Digest classes

[dbussink]

In older Ruby versions, Digest uses legacy OpenSSL APIs to implement the digest methods. These APIs break in some configurations such as FIPS mode enforcement. In the latest Ruby, this was removed (see ruby/ruby#3149), but that means Digest uses the non OpenSSL implementations. In those same environments that want FIPS enforcement, that is not desired as all crypto operations should be using OpenSSL there.

In ruby/openssl#377, it is discussed to replace the constants when OpenSSL is loaded. But what is a limiting factor here, is that OpenSSL doesn't have the equivalent of Digest::SHA2 (which really ends up computing a SHA256 digest).

So this removes the usage of Digest::SHA2 which is harder to wrap and also recommends to use the OpenSSL digest by default.

[radar]

PR LGTM. Thank you @dbussink!

[dbussink]

Is this still the link that should be here?

This question also led me to look a bit further and update the tests as well to show using an OpenSSL Digest instead.

[radar]

I looked at this PR again today and thought that the difference between Digest::SHA2 and OpenSSL::Digest::SHA256 might confuse future people.

Here's something that shows they're equivalent:

require 'digest/sha2'
require 'openssl'
Digest::SHA2.hexdigest("foo") === OpenSSL::Digest::SHA256.hexdigest("foo")

[radar]

Thank you @dbussink!