add test for ingress Post Quantum curves support

Signed-off-by: Evgeny Slutsky <eslutsky@redhat.com>

Author: eslutsky

test/suites/optional/tls-scanner.robot

@@ -49,6 +49,9 @@ TLS Scanner Host Scan Completes And Produces Artifacts
     ...    Cleanup TLS Scanner Job
     ...    Ensure Cluster Reader Role Deleted
 
+Ingress Router TLS Curves supports ML-KEM Post Quantum Curves
+    [Documentation]    Verify TLS curve negotiation with openssl from inside the router pod.
+    Verify ML-KEM Post Quantum Curve Negotiation
 
 *** Keywords ***
 Check Required Scanner Variables
@@ -123,3 +126,19 @@ Cleanup TLS Scanner Job
     IF    '${TLS_SCANNER_DIR}' != ''
         Run Keyword And Ignore Error    Remove Directory    ${TLS_SCANNER_DIR}    recursive=True
     END
+
+Verify ML-KEM Post Quantum Curve Negotiation
+    [Documentation]    Verify X25519MLKEM768 post-quantum hybrid key exchange
+    ...    negotiates successfully via oc exec into the router pod, which
+    ...    has OpenSSL 3.5+ (the host OpenSSL may be too old for ML-KEM).
+    ...    Skipped on FIPS clusters where ML-KEM is not configured.
+    ${router_ip}=    Oc Get JsonPath    svc    openshift-ingress    router-default
+    ...    .spec.clusterIP
+    ${pod_name}=    Oc Get JsonPath    pod    openshift-ingress    ${EMPTY}
+    ...    .items[0].metadata.name
+    ${output}=    Oc Exec    ${pod_name}
+    ...    echo Q | openssl s_client -connect ${router_ip}:443 -groups X25519MLKEM768 2>&1 || true
+    ...    ns=openshift-ingress
+    Should Contain    ${output}    Negotiated TLS1.3 group: X25519MLKEM768
+    ...    msg=ML-KEM post-quantum curve X25519MLKEM768 negotiation failed
+    Log    Post-quantum ML-KEM negotiation verified: OK