fix: hashlib.sha1 FIPS crash in tui_gateway/server.py and optional-skills/dossier.py

[JonthanaHanh]

Summary

Add usedforsecurity=False to two remaining hashlib.sha1() calls that crash on FIPS-enabled systems (RHEL 8/9).

Changes

• tui_gateway/server.py:11677 — revision hash for MCP config change detection
• optional-skills/security/unbroker/scripts/dossier.py:25 — opaque subject ID generation

Both calls use SHA-1 for non-security purposes (content hashing, unique ID generation). On FIPS-enabled systems, hashlib.sha1() without usedforsecurity=False raises ValueError: EVP_DigestInit_ex disabled for FIPS.

Background

This is the same pattern fixed in prior PRs for other files:

• fix: hashlib.md5 FIPS crash in context_compressor.py #56715 (context_compressor.md5)
• fix: hashlib.sha1 FIPS crash in codex_responses_adapter.py #56716 (codex_responses_adapter.sha1)
• fix: hashlib FIPS crash in gateway and tools modules #56719 (gateway/platforms + skills_hub)
• fix: add usedforsecurity=False to hashlib md5/sha1 in skills_hub, skills_sync, web_server #62654 (skills_sync, skills_hub, web_server)
• fix: hashlib FIPS crash in qqbot, wecom, yuanbao_media (md5/sha1 without usedforsecurity=False) #64062 (qqbot, wecom, yuanbao_media)
• fix: add usedforsecurity=False to hashlib.md5 in weixin adapter (FIPS crash) #66857 (weixin.md5)

These two call sites were missed in those earlier batches. SHA-256 is FIPS-approved and does not need this parameter.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #77391: the current patch changes the same two FIPS SHA-1 call sites with the same usedforsecurity=False mechanism.