Add openssl to dependencies.

The new X509 certificate check spawns `openssl s_client`, so ensure the
binary is available. It should be pulled by ca-certificates already but
let's be extra sure.