Fix build with boringssl

[mGaosi]

/usr/bin/ld:./rdkafka/lib/x64-linux/debug/librdkafka.a(rdkafka_admin.c.o): in function `rd_kafka_UserScramCredentialUpsertion_new':
./src/rdkafka_admin.c:6037: undefined reference to `RAND_priv_bytes'
./rdkafka/lib/x64-linux/debug/librdkafka.a(rdkafka_ssl.c.o): in function `rd_kafka_ssl_set_certs':
./src/rdkafka_ssl.c:1542: undefined reference to `SSL_CTX_use_cert_and_key'

The SSL_CTx_use_cert_nd_key function is not available in BoringSSL. This function is a convenience function introduced in OpenSSL 1.1.1, used to simultaneously set certificates, private keys, and certificate chains. In BoringSSL, you need to call the corresponding functions separately to achieve the same functionality.

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
✅ mGaosi
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull Request Overview

This PR fixes build compatibility with BoringSSL by providing alternative implementations for SSL functions that are not available in BoringSSL. The changes address linker errors where BoringSSL lacks certain OpenSSL convenience functions.

• Replaces SSL_CTX_use_cert_and_key with individual SSL certificate/key functions for BoringSSL
• Adds a macro definition to map RAND_priv_bytes to RAND_bytes for BoringSSL compatibility

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/rdkafka_ssl.c	Implements BoringSSL-compatible certificate and key loading using individual SSL functions
src/rdkafka_admin.c	Adds macro to map RAND_priv_bytes to RAND_bytes for BoringSSL

Comments suppressed due to low confidence (1)

[Copilot]

Using RAND_bytes instead of RAND_priv_bytes may have security implications. RAND_priv_bytes is specifically designed for generating private key material and may use different entropy sources. Consider using a BoringSSL-specific secure random function or document this security trade-off.

Suggested change

	#ifdef OPENSSL_IS_BORINGSSL
	#define RAND_priv_bytes(x, sz) RAND_bytes((x),(sz))
	#endif
	#ifdef OPENSSL_IS_BORINGSSL
	#ifdef OPENSSL_IS_BORINGSSL
	/* BoringSSL does not implement RAND_priv_bytes. Using RAND_bytes as a fallback.
	* Note: RAND_bytes is less secure for generating private key material. */
	#define RAND_priv_bytes(x, sz) RAND_bytes((x),(sz))
	#endif
	#endif