build: vendor openssl so the CLI cross-compiles cleanly

cargo-zigbuild for aarch64-unknown-linux-gnu failed at openssl-sys
because pkg-config can't find target-arch openssl headers, and we
can't easily provide them outside the workspace. The transitive pull
is:

  iroh -> pkarr -> reqwest 0.13 (default features = "default-tls") ->
  hyper-tls -> native-tls -> openssl-sys

reqwest 0.13 ships from pkarr's lockfile with native-tls included.
Patching iroh/pkarr to switch reqwest features isn't on our path; the
workspace's own reqwest 0.12 dep is unrelated (and adding
default-features = false there doesn't reach the 0.13 instance —
they're separate version-graph nodes).

Add `openssl = { version = "0.10", features = ["vendored"] }` to the
CLI. Cargo feature unification enables the vendored build for the
transitive openssl-sys, so cross-compiling no longer needs target-arch
system headers — openssl gets compiled from source as part of the
build. Static link, no runtime libssl/libcrypto dependency.

Verified: native check passes, aarch64-unknown-linux-gnu cross-build
via cargo-zigbuild produces a valid 251MB unstripped ARM aarch64 ELF.

Author: drewr

Cargo.lock

@@ -25,4 +25,11 @@ hex.workspace = true
 sentry.workspace = true
 rustls = { workspace = true, features = ["ring"] }
 inquire = "0.9.4"
-reqwest.workspace = true
+reqwest.workspace = true
+# Bring in openssl with the `vendored` feature so cross-compiles (e.g.
+# cargo-zigbuild for aarch64-linux/apple) build openssl from source
+# instead of needing target-arch system headers. The dep is transitively
+# pulled by iroh's pkarr -> reqwest 0.13 (default features include
+# native-tls); we can't disable that without patching iroh, so we
+# vendor instead.
+openssl = { version = "0.10", features = ["vendored"] }