A connection with key-mgmt=wpa-psk should be able to connect to WPA, WPA2 and WPA3 APs, choosing the best candidate automatically.
Also pass SAE (WPA3) key-mgmt to wpa_supplicant when it is supported.
For example, I now get this when connecting to a WPA2 network:
<info> [1613749711.2915] Config: added 'key_mgmt' value 'WPA-PSK WPA-PSK-SHA256 FT-PSK SAE FT-SAE'
The following wpa_supplicant patch is needed: http://lists.infradead.org/pipermail/hostap/2021-February/039406.html