Update the NEWS to reflect reality.

FIPS mode is an OpenSSL feature and we don't require OpenSSL. So anyone wanting to rely on this will need to ensure their build includes Modules/_hashopenssl.c as `_hashlib` linked appropriately.

Author: gpshead

Misc/NEWS.d/next/Library/2024-11-26-16-31-40.gh-issue-127298.jqYJvn.rst

@@ -1,4 +1,8 @@
-:mod:`hashlib`'s fallback builtin hash implementations now check
-usedforsecurity=False, when hashlib is in FIPS mode. This ensures that
-approved-only implementations are in use on FIPS systems by default.
-The builtin implemenations are made available for unapproved use only.
+:mod:`hashlib`'s builtin hash implementations now check ``usedforsecurity=False``,
+when the OpenSSL library default provider is in OpenSSL 3's FIPS mode.  This helps
+ensure that only US FIPS approved implementations are in use by default on systems
+configured as such.
+
+This is only active when :mod:`hashlib` has been built with OpenSSL implementation
+support and said OpenSSL library includes the FIPS mode feature.  Not all variants
+do, and OpenSSL is not a *required* build time dependency of ``hashlib``.