openssl: add option to omit deprecated APIs