Adds OCSP support for BoringSSL

[randall]

No description provided.

[maskit]

Two comments for now.

Maintenance - Having a snapshot of OpenSSL source code sounds a bit scary because it could bring security issues. I think we should have a very easy way to update the snapshot instantly. If there are modifications against the original code we should probably keep them as patch files as well.

License - OpenSSL 3.0 and the code on their master branch are licensed under AL2. Although I didn't check whether the current license is compatible with AL2, AL2 version would be safer option in terms of licensing. The code on master may be unstable so I'm also ok with using non-AL2 version for now as long as the license is compatible.
https://www.openssl.org/source/license.html

[randall]

License - OpenSSL 3.0 and the code on their master branch are licensed under AL2. Although I didn't check whether the current license is compatible with AL2, AL2 version would be safer option in terms of licensing. The code on master may be unstable so I'm also ok with using non-AL2 version for now as long as the license is compatible.
https://www.openssl.org/source/license.html

The APIs/underlying structures have changed enough to make this not a trivial thing to do. This is not the first openssl code to be added to the project. It looks like parts of BIO_fastopen.cc is copied from the project into our tree.

commit d02e88eb0db871a14279da28af819b5f19a945ac
Author: Leif Hedstrom <leif@ogre.com>
Date:   Fri Feb 17 21:54:45 2017 -0700

    Added the OpenSSL license

[randall]

Maintenance - Having a snapshot of OpenSSL source code sounds a bit scary because it could bring security issues. I think we should have a very easy way to update the snapshot instantly. If there are modifications against the original code we should probably keep them as patch files as well.

Personally, I'd like the library "ocsp4boring" to not be checked into the tree itself and rather that it was its own project that other projects could easily build against (like nginx).

[shinrich]

I agree that keeping ocsp4boring out of our source tree seems preferable. And rather user it as a separately installed package.

[randall]

Seems reasonable to move the ocsp4boring code out of tree. I'll follow up with a change to do this.

[maskit]

Some of functions that this PR adds are going to be deprecated on OpenSSL 3.0. ATS uses three of those, and will need to use some replacements.
https://github.com/openssl/openssl/blob/master/doc/man3/OCSP_sendreq_new.pod

Deprecated since OpenSSL 3.0, can be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value, see openssl_user_macros(7):

int OCSP_REQ_CTX_i2d(OCSP_REQ_CT *rctx, const ASN1_ITEM *it, ASN1_VALUE *req);
int OCSP_REQ_CTX_add1_header(OCSP_REQ_CT *rctx,
                             const char *name, const char *value);
void OCSP_REQ_CTX_free(OSSL_HTTP_REQ_CTX *rctx);
void OCSP_set_max_response_length(OCSP_REQ_CT *rctx,
                                  unsigned long len);
int OCSP_REQ_CTX_set1_req(OSSL_HTTP_REQ_CTX *rctx, const OCSP_REQUEST *req);

[randall]

Randall is still working on this.

[zwoop]

Cherry-picked to v9.1.x branch.