Replace local / global openssl-easyrsa.cnf

[TinCanTech]

Previously, Easy-RSA would create a global safe SSL config file, which is
the existing or default openssl-easyrsa.cnf file with all environment
variables expanded to their values ALWAYS.

Then Easy-RSA would create a local SSL config file for specific commands
ONLY, which is the existing or default openssl-easyrsa.cnf file with
environment variables expanded to their values ONLY when required by
the SSL library or forced to by command line option --force-safe-ssl.

With these changes, Easy-RSA now does the following:

1. Create a global safe SSL config file exactly as before and export it
   to $OPENSSL_CONF, for use by any SSL library. This file is specifically
   required by check_serial_unique(), which must have the Easy-RSA CA
   configured file.

2. Use either an existing openssl-easyrsa.cnf file OR provide a default,
   unexpanded tmp-file, which is exported to $EASYRSA_SSL_CONF, for use
   ONLY by Easy-RSA. This must be unexpanded to allow $EASYRSA_REQ_CN to
   be configured by the Easy-RSA command in use (eg. sign-req) once the
   Easy-RSA command line has been fully parsed.

3. When calling easyrsa_openssl(), for LibreSSL or --force-safe-ssl,
   expand the current $EASYRSA_SSL_CONF and export that to $OPENSSL_CONF,
   for use by the called SSL command. Otherwise, use the current, unexpanded
   file and export that.

In summary, the so-called 'local' (on-demand) SSL file has been replaced with
an ALWAYS provided or present openssl-easyrsa.cnf file, be that temporary or
packaged.

[TinCanTech]

This also passes manual and full unit test on OpenBSD with LibreSSL 4.1.0, including Edwards curve algorithm.