Harden OpenSSL source fetch in Docker build to avoid 3.5.8 release-asset 404 failures

[Copilot]

The build workflow failed while building the OpenSSL stage because OPENSSL_VERSION=3.5.8 resolved to a GitHub release-asset URL that returns 404. This PR makes OpenSSL source retrieval resilient to distribution-path differences across upstream hosts.

• Build reliability: OpenSSL download fallback chain

  • Replaced single-source wget with ordered fallback URLs for the same tarball:
    • GitHub release asset
    • GitHub tag archive
    • www.openssl.org current + old/3.5
    • source.openssl.org current + old/3.5
  • Build now errors only after all known sources fail.

• Behavioral scope

  • No change to version selection logic (OPENSSL_VERSION resolution remains unchanged).
  • No change to OpenSSL build/configure/install flow after tarball retrieval.

OPENSSL_TARBALL="openssl-${OPENSSL_VERSION}.tar.gz"
OPENSSL_URLS="...release... ...archive... ...openssl.org... ...source.openssl.org..."
DOWNLOAD_OK=0
for URL in ${OPENSSL_URLS}; do
  if wget -O "${OPENSSL_TARBALL}" "${URL}"; then
    DOWNLOAD_OK=1
    break
  fi
done
[ "${DOWNLOAD_OK}" -eq 1 ] || { echo "ERROR: Failed to download OpenSSL ${OPENSSL_VERSION} from all known sources"; exit 1; }