libressl: improved pem handling

Changes:

* Makes LibreSSL non-dependent on Brewed-OpenSSL being available for CA
creation and thus actual useful functionality. This steals the
bootstrapping method from OpenSSL and replicates it for the same
function here.
* Changes some of the handling of HEAD to reflect new upstream
developments.
* Revision to actually make LibreSSL functional, since without a
functioning pem it isn’t a lot of use in real use-cases.
libressl: update 2.1.1_1 bottle.