Gate VAES codepaths on is_hwaes to fix a theoretical concern

This is a theoretical concern because no x86 CPU has VAES without
AES-NI. However, since we have the testing-only environment variable, it
is in theory possible for someone to set the wrong thing.

This is easy enough to add, so we may as well, but we do not, in
general, consider unreasonable CPUIDs to be in scope. (There are other
environment variables like LD_PRELOAD that do even more uncontrolled
things! And reruning tests across every possible fake CPUID is
unreasonable. At least real CPUIDs are bounded.)

I've filed crbug.com/552976703 to consider whether we want to keep this
thing.

Fixed: 552666770
Change-Id: Ie5909ffb953f97286fba7b61ab09a5a436a0cef4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101787
Reviewed-by: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Adam Langley <agl@google.com>

crypto/fipsmodule/aes/gcm.cc.inc

diff --git a/crypto/fipsmodule/aes/gcm.cc.inc b/crypto/fipsmodule/aes/gcm.cc.inc
index 0e6f771..732a76c 100644
--- a/crypto/fipsmodule/aes/gcm.cc.inc
+++ b/crypto/fipsmodule/aes/gcm.cc.inc
@@ -276,10 +276,10 @@
 
 #if !defined(OPENSSL_NO_ASM)
 #if defined(OPENSSL_X86_64)
-  if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx512 &&
+  if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx512 && is_hwaes &&
       CRYPTO_is_VAES_capable()) {
     gcm_key->impl = gcm_x86_vaes_avx512;
-  } else if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx2 &&
+  } else if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx2 && is_hwaes &&
              CRYPTO_is_VAES_capable()) {
     gcm_key->impl = gcm_x86_vaes_avx2;
   } else if (gcm_key->ghash == gcm_ghash_avx && is_hwaes) {