use downstream packages as fallback

Cryptography is currently broken upstream due to deprecation of OpenSSL
engines in Fedora 41+ and CentOS Stream 10. I managed to merge a fix
upstream, but it will take some time until they release a new version.
For more details, see the GitHub issue:
pyca/cryptography#11690

When upstream installation fails, --use-system-packages allows using
downstream packages as a fallback. Downstream packages have an advantage
of being tuned to the distribution, which can resolve these kinds of
issues.

Some context for not having --use-system-packages from Fabio:
it was to stress the build system in different ways
one env might have python3-foo installed, another doesn't
causing different results
say today: we test pcs build X and it works
tomorrow some other packages pulls in python3-something that goes from embedded to system
and then pcs starts to fail
it creates a rather unpredictable build env
on rhel8 we could use system stuff, and we needed it IIRC
others can have all embedded

ci-setup-src

@@ -25,21 +25,18 @@ if [ -f ./configure ]; then
      localbuild=""
      usesitepackages=--system-site-packages
      ;;
-    rhel-8*)
-     localbuild=--enable-local-build
-     usesitepackages=--system-site-packages
-     ;;
     *)
      localbuild=--enable-local-build
-     usesitepackages=""
+     usesitepackages=--system-site-packages
      ;;
    esac
    rm -rf .venv
    python3 -m venv $usesitepackages .venv
    . .venv/bin/activate
    export PATH="$(pwd)/.venv"/bin/:$PATH
    python3 -m pip install setuptools-scm setuptools-rust wheel
-   python3 -m pip install concurrencytest cryptography lxml pycurl six pyparsing
+   python3 -m pip install concurrencytest lxml pycurl six pyparsing
+   python3 -m pip install cryptography || :
    echo "./configure --enable-destructive-tests --enable-parallel-tests $localbuild $DISTROCONFOPTS PKG_CONFIG_PATH=$EXTERNAL_CONFIG_PATH"
    ./configure --enable-destructive-tests --enable-parallel-tests $localbuild $DISTROCONFOPTS PKG_CONFIG_PATH=$EXTERNAL_CONFIG_PATH
    ;;

ci-update-apt

@@ -74,6 +74,7 @@ required_pkg pkg-config
 required_pkg psmisc
 required_pkg puma
 required_pkg python3-boto3
+required_pkg python3-cryptography
 required_pkg python3-dev
 required_pkg python3-googleapi
 required_pkg python3-lxml