OpenSSL integration

[ctz]

This is ready for review. I am working ahead from here on a curl integration (mainly build system work!) so won't merge this until that proves this out fully.

[codspeed-hq]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing jbp-openssl (afe9559) with main (00e16fb)}

[ctz]

Kinda works though:

$ export LD_PRELOAD=./libupkiopenssl-preload.so

curl:

$ curl https://certdemo-dv-revoked-rsa.tls.d-trust.net/
curl: (60) SSL certificate problem: certificate revoked
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

python:

$ python -c "import urllib.request; print(urllib.request.urlopen('https://certdemo-dv-revoked-rsa.tls.d-trust.net/').read())"
Traceback (most recent call last):
  File "/usr/lib/python3.12/urllib/request.py", line 1344, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
(... world's largest stack trace ...)
  File "/usr/lib/python3.12/urllib/request.py", line 1392, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/urllib/request.py", line 1347, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate revoked (_ssl.c:1000)>

openssl CLI:

$ openssl s_client -connect certdemo-dv-revoked-rsa.tls.d-trust.net:443 -verify_return_error | tail
8097F182FC6F0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1889:
Verification error: certificate revoked
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 23 (certificate revoked)
---

[ctz]

I've moved this along a bit, and I think it is now robust. I've dropped the preload commit for now. The remaining work here is around testing, as currently the new artifact libupkiopenssl.so is entirely untested.