fix(installer): repair OpenSSL fallback in hash_sha256 (#5521)

Motivation: when gsha256sum, sha256sum and shasum are all absent but openssl
is available, install.sh fails checksum verification. The fallback ran
`openssl -dst openssl dgst -sha256`, which is an invalid command, and would
also have failed on `cut -d ' ' -f a`, an invalid field argument. The
installer exits 1 and installs nothing; checksum verification is not bypassed.

Approach: call `openssl dgst -sha256 "$TARGET"` and take the digest as the
last space-separated token of its "SHA256(file)= <digest>" output
(also "SHA2-256(...)" on OpenSSL 3.x), using POSIX parameter expansion.

Validation: added test_hash_sha256_openssl in test/install/0_checksums_test.sh,
which overrides is_command so only openssl is found and checks the digest of
the fixture archive (file and stdin). Running `sh 0_checksums_test.sh` in
test/install fails on the test before the change ("Invalid command '-dst'")
and passes after. Run on macOS with the system openssl only; the full
installer run from the issue and the container-based make targets were not run.

Report: https://github.com/anchore/syft/issues/5520

Assisted-by: claude-sonnet-5-5 (via Claude Code)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

install.sh

@@ -257,8 +257,9 @@ hash_sha256() (
     hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
     echo "$hash" | cut -d ' ' -f 1
   elif is_command openssl; then
-    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
-    echo "$hash" | cut -d ' ' -f a
+    hash=$(openssl dgst -sha256 "$TARGET") || return 1
+    # output is "SHA256(<file>)= <digest>" (or "SHA2-256(...)" on OpenSSL 3.x)
+    echo "${hash##* }"
   else
     log_err "hash_sha256 unable to find command to compute sha-256 hash"
     return 1