libressl: improve pem handling

Doing a few things here:

* Brings LibreSSL into line with how we handle OpenSSL. See #34735 for the OpenSSL equal, and #34728 for the original issue that drove all this.
* Makes LibreSSL non-dependent on Brewed-OpenSSL being available for CA creation and thus actual useful functionality. This steals the bootstrapping method from OpenSSL and replicates it for the same function here.
* Changes some of the handling of HEAD to reflect new upstream developments.