[boorad]

Add a default-off NCRYPTO_EVP_ONLY profile for OpenSSL 3.6+ consumers that build with deprecated declarations treated as errors.

The profile excludes ENGINE declarations and implementation, propagates NCRYPTO_EVP_ONLY=1 through CMake and pkg-config, and avoids the existing deprecated-declaration and unused-parameter warning suppressions. Unsupported backends/versions are rejected. Default backend selection remains unchanged.

Small source cleanups handle unused parameters and check the X509 parser's BIO rewind so all three translation units and an independent public-header consumer compile under strict warnings. The profile does not change prime-check behavior or include the separate provider serialization fixes.

Validation at 61b5c38832237e8c2a1c3c5531daeb5cdbf0b16f on macOS:

• OpenSSL 3.6.2 CMake Release builds with NCRYPTO_EVP_ONLY=OFF and ON: 29/29 tests pass in each mode.
• Pinned BoringSSL 0.20260508.0, default profile: 25/25 tests pass.
• All three source units and an independent header consumer compile with -std=c++20 -DNCRYPTO_EVP_ONLY=1 -Wall -Wextra -Werror -Wdeprecated-declarations.
• Changed C++ files pass clang-format and git diff --check.

This PR is independent of the separate provider behavioral-fixes proposal.

[panva]

please propose any applicable changes in nodejs/node first

[boorad]

@panva The applicable behavioral fixes are now proposed in nodejs/node#67039. This PR adds a standalone CMake/pkg-config build profile. Should its shared-source guards and warning cleanups go through Node first, with only the standalone build integration proposed here afterward?