Try to load OpenSSL 3 libraries when compiled with OpenSSL-Dynamic
support.

Handle the deprecated symbol renaming of SSL_get_peer_certificate to
SSL_get1_peer_certificate -- try to load the old name and if it fails,
use the new one.

The builtin hash uses the code verbatim from rfc6234, including
prototypes for functions that we don't use (like hmac). Remove all
unused prototypes to avoid collisions with things that an operating
system might provide (like hmac).

It conflicts with NetBSD's in its libc.

Closes #6457

gcc (mingw) warns when you cast the result of `GetProcAddress`; cast the
results to `void *` before casting them to the actual result.

When GIT_SHA1_WIN32 or GIT_SHA256_WIN32 is used, ensure that we test
both CryptoNG ("cng") and CryptoAPI.

Adding SHA256 support prompted an overdue refactoring of some of the
unnecessary complexity around the CNG/CryptoAPI abstraction.