Remove hard dependency on mcrypt

From #5440 a few key distros (redhat) will be dropping mcrypt support. We can and should switch to openssl earlier. openssl is more widely maintained and easier to use.

I've left the default to be mcrypt mostly out of backwards compatibility issues. Because our earlier implementation of `encrypt()` did not use PKCS#7 the data encrypted by it cannot be decrypted with openssl. For people with both extensions, it would be best if their code didn't break.
Those are both good points, but my concern is this.

* Install has both mcrypt and openssl installed.
* App has data encrypted with existing code (mcrypt).
* Upgrade CakePHP, now no data can be decrypted. Furthermore, there is no error.

Mcrypt is not necessarily _bad_. It just won't be supported on some distros in the future. The goal of these changes was twofold. 

1. Remove the hard dependency on mcrypt. This will allow CakePHP to install on systems with no mcrypt, and openssl only.
2. Allow openssl to be used, as it is actually faster at encrypting data.

If a developer has both extensions installed, they can force the implementation they want with `engine()`.