Add bssl-compat: BoringSSL compatibility layer for OpenSSL

This commit adds the complete bssl-compat library, which provides an
implementation of the BoringSSL API on top of OpenSSL 3.0.x. This allows
Envoy to be built against OpenSSL instead of BoringSSL.

Key components:
- prefixer tool: Generates OpenSSL header wrappers with ossl_ prefix
- Mapping functions: Implement BoringSSL API using OpenSSL calls
- Patch scripts: Control how BoringSSL headers are adapted
- Test suite: Unit tests for compatibility layer functions
- Build files: CMake and Bazel configuration

The compatibility layer handles differences between BoringSSL and OpenSSL:
- Opaque data structures requiring EVP functions
- Different function signatures and return values
- Macro and constant value differences
- Structure layout compatibility

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Jonh Wendell <jwendell@redhat.com>

Author: jwendell

bssl-compat/BUILD

@@ -0,0 +1,53 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "cmake")
+load(":filter_out_shared_libs.bzl", "filter_out_shared_libs")
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+)
+
+licenses(["notice"])  # Apache 2
+
+cmake(
+    name = "bssl-compat-build",
+    lib_source = ":srcs",
+    out_shared_libs = [],
+    out_static_libs = ["libbssl-compat.a"],
+    visibility = ["//visibility:private"],
+    generate_crosstool_file = False,
+    out_binaries = ["utests-bssl-compat"],
+    build_args = [ "-j" ],
+    deps = ["@openssl//:openssl"],
+    cache_entries = {"OPENSSL_ROOT_DIR": "$$EXT_BUILD_DEPS/openssl"},
+    # Add the OpenSSL shared libraries as a *data* dependency, so they get
+    # propagated to dependant targets, and made available in their runfiles
+    # directory when they run, so libbssl-compat.a can dlopen() them.
+    data = ["@openssl//:libs"],
+)
+
+filegroup(
+    name = "utests-bssl-compat",
+    srcs = [":bssl-compat-build"],
+    output_group = "utests-bssl-compat",
+    visibility = ["//visibility:public"],
+)
+
+# This target is identical to :bssl-compat-build but with the OpenSSL shared
+# libraries dependency filtered out, to stop dependants linking against them.
+filter_out_shared_libs(
+    name = "bssl-compat",
+    dep = ":bssl-compat-build",
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "crypto",
+    actual = ":bssl-compat",
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "ssl",
+    actual = ":bssl-compat",
+    visibility = ["//visibility:public"],
+)