RFC: python: use openssl without legacy configuration

[de11n]

Description of changes

Our internal Hydra builds of Nixpkgs have not noticed any additional breakage from removing the legacy module the OpenSSL used by Python.

On the flip side, we have encountered Segfaults which seem similar to openssl/openssl#18049. We've found that removing the legacy module has resolved these issues. (Using OpenSSL 3.0.9, specifically.)

All the same, this is a "big" change that may have unforeseen consequences. For prior art, there is a discussion here where some have also gone the route of OpenSSL 3 + no legacy module.

I'd love to start the discussion on this and see if Nixpkgs is ready for this change.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[ajs124]

#202126 might also have a little context, as that is where this hack was introduced.

[ajs124]

probably superseded by #285158