Document the per-encoder method for fixing OpenSSL's broken defaults

OpenSSL has chosen non-interoperable and unsafe defaults for ML-KEM and
ML-DSA private key serialization. Their only programmatic workaround
sets options globally.

https://github.com/openssl/openssl/pull/29206 added a per-encoder
option. Document that too.

Change-Id: I266e6c0829d0e0eec6167a0aba1ddae26e5d213b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99229
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: David Benjamin <davidben@google.com>

include/openssl/evp.h

diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index ff7ace2..6e310ec 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -190,6 +190,10 @@
 // can be done programmatically with OpenSSL's
 // `OSSL_PROVIDER_add_conf_parameter` function, or by passing "-provparam" to
 // the command-line tool.
+//
+// In OpenSSL 4.0, the defaults can also be fixed on a per-encoder basis by
+// setting the "output_formats" parameter to "seed-only" with
+// `OSSL_ENCODER_CTX_set_params`.
 OPENSSL_EXPORT const EVP_PKEY_ALG *EVP_pkey_ml_dsa_44(void);
 OPENSSL_EXPORT const EVP_PKEY_ALG *EVP_pkey_ml_dsa_65(void);
 OPENSSL_EXPORT const EVP_PKEY_ALG *EVP_pkey_ml_dsa_87(void);
@@ -203,6 +207,10 @@
 // can be done programmatically with OpenSSL's
 // `OSSL_PROVIDER_add_conf_parameter` function, or by passing "-provparam" to
 // the command-line tool.
+//
+// In OpenSSL 4.0, the defaults can also be fixed on a per-encoder basis by
+// setting the "output_formats" parameter to "seed-only" with
+// `OSSL_ENCODER_CTX_set_params`.
 OPENSSL_EXPORT const EVP_PKEY_ALG *EVP_pkey_ml_kem_768(void);
 OPENSSL_EXPORT const EVP_PKEY_ALG *EVP_pkey_ml_kem_1024(void);