switch from openssl to libmd for sha256

Some versions of openssl are perceived to have a problematic
(non-GPL-compatible) license.  For example, lintian in Debian 11 Bullseye
rejects GPL programs linked with openssl:

    E: mesaflash: possible-gpl-code-linked-with-openssl

This commit switches from using openssl to using libmd for SHA256
computation, which does not have this problem (and which is arguably
preferable for being lighter-weight and more focused than openssl).

Note: a slight difference in the APIs of the two implementations requires
the slightly different arguments to SHA256_Update():

    openssl:

        int SHA256_Update(SHA256_CTX *c, const void *data, size_t len);

    libmd:

        void SHA256_Update(SHA25_CTX *, const uint8_t *, size_t);