Single point of versioning, drop the OpenSSL legacy provider, restore Warden.Enabled

[H0zen]

Three independent commits. Each one builds and passes ctest on its own, so please review them one at a time.

1. Single point of versioning: cmake/Revision.cmake + Revision API

Versions used to be set in five places, and revision_data.h had three generators writing the same file. Now:

cmake/Revision.cmake + cmake/BuildRevision.h.in
  -> <build>/revision/BuildRevision.h        (never in the source tree)
  -> included only by src/shared/Common/Revision.cpp
  -> implements src/shared/Common/Revision.h, used by everything else

• One file to edit: cmake/Revision.cmake holds the product version, REVISION_NR, the required realmd/character/world schema and every ConfVersion.
• One translation unit: a commit or version bump recompiles Revision.cpp only. Before, GitRevision.h pulled the generated header into every file that wanted a version string.
• Smaller API: Revision.h replaces GitRevision.h and SystemConfig.h. About 40 getters become about 15, the DB levels become one DbVersion struct, and the config files one table (name, path, ConfVersion).
• Removed: MangosParams.cmake, GenRevision.cmake, EnsureVersion.cmake (unused), src/genrev/, revision_data.h.in, SystemConfig.h.in, GitRevision.*, the unused revision_data.h include in 35 Player*.cpp, and DatabaseVersionTest (it re-hard-coded the schema numbers).
• Submodules: realmd, Eluna and SD3 include GitRevision.h, SystemConfig.h and revision_data.h by name and must not be edited. Forwarders for them live in src/shared/Compat/revision/ and are visible to those targets only.
• Conf files: every *.conf.dist goes through mangos_install_conf(), and mangos_configure() fails the configure if a template names an unset @VAR@. aiplayerbot.conf gets its ConfVersion from Revision.cmake and is no longer generated and installed twice.
• Fixed along the way:
  • The build-time refresh wrote an empty host version, because cmake -P leaves CMAKE_HOST_SYSTEM_VERSION unset.
  • The extractor depended on TARGET revision_data.h, which never existed, and shipped file version 0.0.0. It now uses VersionInfo.h like mangosd and realmd.
• Visible change: .server info prints "Compiled on: …" instead of "Running on: …". The value always was the build host.

2. Drop the OpenSSL legacy provider and the unused ARC4 class

mangosd refused to start without ossl-modules/legacy.dll, and it needed that provider only for EVP_rc4() in ARC4. No production code uses ARC4: the vanilla header cipher is AuthCrypt's own, and Warden has its own RC4 in WardenCryptoContext, which keeps its tests.

• Removed ARC4.*, OpenSSLProvider.*, OpenSSLProviderTest, the ARC4 vector case in CryptoStressTest, the provider start-up check, and the dead pre-3.0 SSLeay branch.
• The tests and Windows CI no longer copy legacy.dll or set OPENSSL_MODULES.
• CheckBuildPolicy now fails if mangosd uses OpenSSLProvider again.

3. Restore the Warden.Enabled master switch

It was removed in 7bf3435 (#475) with no replacement. EnforcementMode = 0 still provisions Warden, sends the module, runs checks and writes audit rows, and an out-of-range mode is normalized to 2 (kick and ban).

• Warden.Enabled = 1 by default. With 0, admission takes the existing no-Warden path, the one already used when a client supplies no admission data: no WardenServer, no checks, no audit rows, no enforcement. Every Warden code path already treats a missing WardenServer as a no-op, and login was never gated on Warden. The session key is still cleansed.
• When it applies: it is read at admission, so a reload affects new sessions only. A disabled Warden is logged at start-up.
• Config: mangosd.conf ConfVersion goes to 2026092400. CheckWardenBoundary requires the default-on setting in code and in the distributed config.

Verification

Full build with -DBUILD_TOOLS=1 -DBUILD_MANGOSD=1 -DBUILD_REALMD=1 -DSOAP=1 -DSCRIPT_LIB_ELUNA=1 -DSCRIPT_LIB_SD3=1 -DPLAYERBOTS=1 -DBUILD_AH_SERVICE=1 -DWITH_TESTS=1:

Commit	MSVC 2022 (Windows)	clang (FreeBSD 15, OpenSSL 3.5)
1	builds; ctest green apart from the 3 legacy-provider cases (the local OpenSSL ships no legacy.dll; commit 2 removes them)	builds; ctest 16/16
2	builds; ctest 16/16	builds; ctest 16/16
3	builds; ctest 16/16	builds; ctest 16/16

• The codestyle script passes. CheckBuildPolicy and CheckWardenBoundary pass.
• Configure shows the same revision on both hosts, and BuildRevision.h exists only under <build>/revision/.
• In the generated MSVC project, only Revision.cpp has that directory on its include path.
• After those runs, commit 1 gained a 6-line guard: cmake_minimum_required in cmake -P mode only. Without it, the build-time revision refresh failed on CMake 3.x, because IN_LIST needs CMP0057. That path is checked with CMake 3.31 script mode. A Ninja + GCC/clang replica of core_linux_build.yml is still running on the final commit; this PR's CI covers the same ground.
• No database migration is needed.

🤖 Generated with Claude Code

---

This change is 

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 11 complexity · 2 duplication

Metric	Results
Complexity	11
Duplication	2

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[AppVeyorBot]

✅ Build Mangos ZERO Server 22.04.482-pwdtbjlf completed (commit dceb578254 by @H0zen)