libressl: improve pem handling

Doing a few things here:

* Brings LibreSSL into line with how we handle OpenSSL. See #34735 for
the OpenSSL equal, and #34728 for the original issue that drove all
this.
* Makes LibreSSL functionality non-dependent on Brewed-OpenSSL being
available. This steals the bootstrapping method from OpenSSL and
replicates it for the same function here.
* Changes some of the handling of HEAD to reflect new upstream
developments.
libressl: update 2.1.1 bottle.