Offer a hybrid ML-KEM key exchange group first

Prepends an ML-KEM hybrid key-exchange group to explicitly configured named-group lists, so that a connection whose groups are pinned can still negotiate post-quantum key exchange. Covers SSLParameters.setNamedGroups and BCSSLParameters.setNamedGroups with a literal array or a same-class private array constant, and System.setProperty("jdk.tls.namedGroups", ...) with a literal value. The group goes first because first means most preferred, which is where JDK 27 puts it by default and where BouncyCastle 1.81 does not — BCJSSE enables the hybrid last, so an explicit hybrid-first list still changes the key share that is offered. Sites that already name any ML-KEM group are left alone silently and produce no row: setNamedGroups throws on a duplicate element, so re-running this recipe has to be a no-op rather than a reordering. Code that configures no named groups at all is deliberately not touched — on JDK 27 that absence is the good state, and inserting a literal list would freeze today's defaults forever. -D flags in shell scripts, Dockerfiles and orchestration manifests are outside a source scan and need a manual audit.