CVE-2026-111878: OpenSSL provider UAF on TLS shutdown

This is an incomplete fix of the earlier `connclose()` mitigation (CVE-2026-80229). That change stops a connection that borrowed a private `OSSL_LIB_CTX` from going back into the connection pool. It does not keep the library context alive until the `SSL_CTX` that borrowed it is destroyed. On the …

/* lib/vtls/openssl.c, ossl_set_provider() */
if(!data->state.libctx) {
  OSSL_LIB_CTX *libctx = OSSL_LIB_CTX_new();
  if(!libctx)
    return CURLE_OUT_OF_MEMORY;
  /* ... optional propq ... */
  data->state.libctx = libctx;
}