openssl: bump to 1.0.1h

Another day, another OpenSSL issue.

As a small unrelated change, I've extended .gitignore to cover more of what gets created in a checked-out sabotage repository during use. It should be more friendly to use a cloned repository as /src now.