Move KKDCP OpenSSL code to an internal plugin

Create an internal pluggable interface "tls" with one in-tree dynamic
plugin module named "krb5tls".  Move all of the OpenSSL calls to the
plugin module, and make the libkrb5 code load and invoke the plugin.
This way we do not load or initialize libssl unless an HTTP proxy is
used.

ticket: 7929