chore: depend on openssl-sys to correctly pin its version (#15224)

### What does this PR try to resolve?

From
#13546 (comment)

> This was an overlook in
<#15166> and apparently we forgot
to actually add openssl-sys to `cargo` package. The pinned version is
[under
`workspace.dependencies`](#15166)
so it never really affect the dependency resolution.
>
> The bad news is that <#15166>
is now in beta toolchain already. If we're going to fix this again we
might need to revert it in beta as well.

This PR fixes it. However, I think we should find a way to unpin the
version.

### How should we test and review this PR?

If we're going to merge this, we might want to backport to beta

Author: ehuss

Cargo.lock

@@ -234,6 +234,7 @@ cargo-credential-macos-keychain.workspace = true
 
 [target.'cfg(not(windows))'.dependencies]
 openssl = { workspace = true, optional = true }
+openssl-sys = { workspace = true, optional = true } # HACK: for pinning to openssl v1.
 
 [target.'cfg(windows)'.dependencies]
 cargo-credential-wincred.workspace = true