tools: add non-default OpenSSL versions to the test-shared workflow

[panva]

Adds an additional OpenSSL shared-libraries matrix to test-shared.yml so PRs run against additional supported OpenSSL releases. No more waiting for a full CI to find out a crypto/TLS change is broken on another version 🙏.

• build-openssl now uses a committed matrix in test-shared.yml, regenerated by the existing weekly nixpkgs-unstable updater so the pin bump and tested OpenSSL variants stay in sync in a single PR.
• The updater derives the matrix from the pinned nixpkgs and https://endoflife.date, dropping EOL versions, versions missing from the pinned nixpkgs, while keeping ones that still have extended support such as 1.1.1.
• SUPPORTED_OPENSSL_VERSION remains a manually maintained value in tools/nix/collect-openssl-matrix.sh, and drives per-entry continue-on-error in the autogenerated matrix so releases newer than what we explicitly support do not fail GHA.

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[aduh95]

Adding extra GHA workflows comes at the expense of spending more minutes to prepare security releases. We can skip the test-shared workflow on the private repo, but idk if it's worth it given that there are some path that we only run on that workflow.
That being said, there's certainly some value to run more variants on GHA, maybe we need to gate them behind github.repository == 'nodejs/node'

[panva]

but idk if it's worth it given that there are some path that we only run on that workflow

The OpenSSL versions are a big gap. Since we don't/can't keep up with the versions in CI.

[aduh95]

I did another pass at this PR, and tested aduh95@a01a6ef. Could you have a look, and feel free to pull it and/or adapt from it

[panva]

@aduh95 looks great, i pulled it in and lint-fixed it

[nodejs-github-bot]

Landed in 0f68423

[Renegade334]

• The updater derives the matrix from the pinned nixpkgs and https://endoflife.date, dropping EOL versions, versions missing from the pinned nixpkgs, while keeping ones that still have extended support such as 1.1.1.

So where are we with OpenSSL 1.x support? The conversation in #56733 was approaching whether to withdraw this for v24.x, whereas we appear to be upping our integration a year later?