* cipher/cipher.c (_gcry_cipher_open_internal): Check and mark if the
cipher mode is compliant and reject accordingly.
(_gcry_cipher_is_mode_fips_compliant): New.
* src/gcrypt.h.in (GCRY_FIPS_FLAG_REJECT_CIPHER_MODE): New.
* tests/t-fips-service-ind.c (check_cipher_o_s_e_d_c): Add test to
verify that the service level indication is correctly set for non-
compliant cipher modes, and correctly rejected if
GCRY_FIPS_FLAG_REJECT_CIPHER_MODE is set.