feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/openssl-cve-2024-4603/fixed.c

@@ -0,0 +1,28 @@
+/* Provenance: openssl/openssl ossl_dsa_check_params (fixed).
+ * repo: openssl/openssl
+ * commit: 3559e868e58005d15c6013a0c1fd832e51c73397
+ * parent: d4b119c567cb5dcaf83add7ca2ea1d646eb3ef9f
+ * commit_url: https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397
+ * cve: CVE-2024-4603
+ * license: Apache-2.0
+ * function: ossl_dsa_check_params
+ * relpath: crypto/dsa/dsa_check.c
+ */
+
+int ossl_dsa_check_params(const DSA *dsa, int checktype, int *ret)
+{
+    if (!dsa_precheck_params(dsa, ret))
+        return 0;
+
+    if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK)
+        return ossl_ffc_params_simple_validate(dsa->libctx, &dsa->params,
+                                               FFC_PARAM_TYPE_DSA, ret);
+    else
+        /*
+         * Do full FFC domain params validation according to FIPS-186-4
+         *  - always in FIPS_MODULE
+         *  - only if possible (i.e., seed is set) in default provider
+         */
+        return ossl_ffc_params_full_validate(dsa->libctx, &dsa->params,
+                                             FFC_PARAM_TYPE_DSA, ret);
+}