upgrade to OpenSSL 1.0.2p

[robbkidd]

Updating omnibus-software will pull in the new OpenSSL default version of 1.0.2p which addresses two CVEs.

• Client DoS due to large DH parameter (CVE-2018-0732)
• Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)

Both of these CVEs are categorized as Low by the OpenSSL project. Neither are particularly present in Supermarket's business processes. Updating to this version will quiet vulnerability scanners.

[robbkidd]

Manifest entry from an ad-hoc build of this branch:

            "openssl": {
                "locked_version": "1.0.2p",
                "locked_source": {
                    "url": "https://www.openssl.org/source/openssl-1.0.2p.tar.gz",
                    "extract": "lax_tar",
                    "sha256": "50a98e07b1a89eb8f6a99477f262df71c6fa7bef77df4dc83025a2845c827d00"
                },
                "source_type": "url",
                "described_version": "1.0.2p",
                "license": "OpenSSL"
            },

👍

[tyler-ball]

[pwelch]

LGTM 👍