Update static OpenSSL pin to 3.5.7

[SeriousPassenger]

Summary

• advance the managed static dependency from OpenSSL 3.5.5 to 3.5.7, the current published patch in the OpenSSL 3.5 LTS series
• replace the pinned source SHA-256 with the official 3.5.7 digest
• update README, third-party provenance, cached paths, and CI assertions together

OpenSSL 3.5.7 source SHA-256:

a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8

Official release listing: https://www.openssl-library.org/source/

Validation

• fresh make -j4 static-check downloaded, verified, built, and tested OpenSSL 3.5.7
• cached make -j4 CURL=/bin/false static-check passed without network access
• all ArborKDF unit, CLI, wordlist, recovery, and known-answer tests passed
• known derivation output remained byte-for-byte unchanged
• file reports a statically linked ELF; readelf shows no PT_INTERP or DT_NEEDED
• managed libcrypto.a has no unresolved jitter, zstd, Brotli, DSO, or resolver symbols
• repository scan finds no remaining 3.5.5 version or digest references outside ignored dependency caches