Repository: PrefectHQ/prefect

Issue:
MD5 not supported without usedforsecurity=False in FIPS 140-2 environment
### First check

- [X] I added a descriptive title to this issue.
- [X] I used the GitHub search to find a similar issue and didn't find it.
- [X] I searched the Prefect documentation for this issue.
- [X] I checked that this issue is related to Prefect and not one of its dependencies.

### Bug summary

The md5 algorithm is compromised and forbidden in FIPS environments. 

The Prefect library explicitly uses hashlib.md5 in multiple locations, which makes it impossible to run Prefect 2.x with strict FIPS enforcement. However, Prefect version 1.x can function in strict FIPS environments.

Dask was using md5 for simple hashing (not security) which is permitted in FIPS environments, but it requires an extra parameter introduced in Python 3.9+; see:
- [#8608](https://github.com/dask/dask/issues/8608)
- [#8762](https://github.com/dask/dask/pull/8762)
- [#48024](https://github.com/pandas-dev/pandas/issues/48024)

The `hash_algo` is an input parameter to many of the methods in `utilities/hashing.py`, but it doesn't seem like there's any method to allow the user to override this with a different hashing algorithm.

### Reproduction

```python3
1. Install Prefect 2.x on a system with strict FIPS 140-2 enforcement
2. Attempt to run a simple Prefect Flow locally
```


### Error

```python3
/opt/python/lib/python3.10/site-packages/prefect/flows.py:619: in flow
    Flow(
/opt/python/lib/python3.10/site-packages/prefect/context.py:176: in __register_init__
    __init__(__self__, *args, **kwargs)
/opt/python/lib/python3.10/site-packages/prefect/flows.py:158: in __init__
    version = file_hash(flow_file)
/opt/python/lib/python3.10/site-packages/prefect/utilities/hashing.py:41: in file_hash
    return stable_hash(contents, hash_algo=hash_algo)
/opt/python/lib/python3.10/site-packages/prefect/utilities/hashing.py:22: in stable_hash
    h = hash_algo()
E   ValueError: [digital envelope routines] disabled for fips
```


### Versions

```Text
Version:             2.6.8
API version:         0.8.3
Python version:      3.10.8
Git commit:          68044e28
Built:               Thu, Nov 17, 2022 3:19 PM
OS/Arch:             darwin/arm64
Profile:             default
Server type:         ephemeral
Server:
  Database:          sqlite
  SQLite version:    3.39.4
```


### Additional context

Ideally, stop using md5 for hashing; but if required follow the example from Dask. Perhaps a sha512 hash would be a better default?

Pandas opted to use UUID instead for their hashing to get around a similar problem, but I don't think that will work with the object hashing Prefect is doing.

Or make it possible for the end-user to easily configure which `default` hashing algorithm is used across the `utilities/hashing.py` methods.


Discussion:

Resolving patch:
diff --git a/src/prefect/utilities/hashing.py b/src/prefect/utilities/hashing.py
--- a/src/prefect/utilities/hashing.py
+++ b/src/prefect/utilities/hashing.py
@@ -1,4 +1,6 @@
 import hashlib
+import sys
+from functools import partial
 from pathlib import Path
 from typing import Optional, Union
 
@@ -6,8 +8,13 @@
 
 from prefect.serializers import JSONSerializer
 
+if sys.version_info[:2] >= (3, 9):
+    _md5 = partial(hashlib.md5, usedforsecurity=False)
+else:
+    _md5 = hashlib.md5
 
-def stable_hash(*args: Union[str, bytes], hash_algo=hashlib.md5) -> str:
+
+def stable_hash(*args: Union[str, bytes], hash_algo=_md5) -> str:
     """Given some arguments, produces a stable 64-bit hash of their contents.
 
     Supports bytes and strings. Strings will be UTF-8 encoded.
@@ -27,7 +34,7 @@ def stable_hash(*args: Union[str, bytes], hash_algo=hashlib.md5) -> str:
     return h.hexdigest()
 
 
-def file_hash(path: str, hash_algo=hashlib.md5) -> str:
+def file_hash(path: str, hash_algo=_md5) -> str:
     """Given a path to a file, produces a stable hash of the file contents.
 
     Args:
@@ -41,7 +48,7 @@ def file_hash(path: str, hash_algo=hashlib.md5) -> str:
     return stable_hash(contents, hash_algo=hash_algo)
 
 
-def hash_objects(*args, hash_algo=hashlib.md5, **kwargs) -> Optional[str]:
+def hash_objects(*args, hash_algo=_md5, **kwargs) -> Optional[str]:
     """
     Attempt to hash objects by dumping to JSON or serializing with cloudpickle.
     On failure of both, `None` will be returned


Test patch: