netops: init OpenSSL once under lock

The OpenSSL init functions are not reentrant, which means that running
multiple fetches in parallel can cause us to crash.

Use a mutex to init OpenSSL, and since we're adding this extra checks,
init it only once.
ssl: use locking

When using in a multithreaded context, OpenSSL needs to lock, and leaves
it up to application to provide said locks.

We were not doing this, and it's just luck that's kept us from crashing
up to now.
wip

ssl: cargo-cult thread safety

OpenSSL's tests init everything in the main thread, so let's do that.