Function is_cipher_suite_disallowed 

pub fn is_cipher_suite_disallowed(cipher: &str) -> bool

True when FIPS mode is active and the given cipher suite name is NOT on the FIPS-approved allowlist. Used by snapshot validation to reject non-approved cipher suite configs.

When FIPS mode is disabled (OSS), always returns false (no rejection).