resolved: load libcrypto/libssl lazily on first use and make them optional (#42681)

Currently they are marked as required, as resolved aborts on startup if
dns-over-tls is built in, even if it is not enabled in the config.
Change initialization to be done lazily on first use, so that if the
config is not enabled, it never runs, and the libraries are never
dlopened, so they can be downgraded to recommends.

src/shared/ssl-util.h

@@ -55,6 +55,7 @@ extern DLSYM_PROTOTYPE(TLS_client_method);
         sym_SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MIN_PROTO_VERSION, (version), NULL)
 
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL*, sym_SSL_free, SSL_freep, NULL);
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(SSL_CTX*, sym_SSL_CTX_free, SSL_CTX_freep, NULL);
 
 #else
 #define DLOPEN_LIBSSL(log_level, priority) dlopen_libssl(log_level)