CI: also build cryptography against the system OpenSSL for the glibc243 Linux binaries

[ThomasWaldmann]

Follow-up to #10346 for #10345.

#10346 built cryptography against the bundled OpenSSL only in the oldglibc_binary job (glibc239 binaries). The Linux binaries from native_tests (ubuntu-26.04, glibc243) still bundle two OpenSSLs: the system's libcrypto (Ubuntu 26.04 ships OpenSSL 3.5.5), which borg's crypto extension uses and PyInstaller bundles, and the copy statically linked into the manylinux wheel of cryptography (a paramiko dependency, sftp extra).

This builds cryptography from source against the system OpenSSL there, too, for the Linux binary matrix entries (the runner image has the Rust toolchain; the build takes about a minute). The step checks that the extension links libcrypto dynamically and loads the same OpenSSL version as the system's openssl program; the smoke test of the built binary checks that the bundled extension links the bundled libcrypto, and prints the bundle sizes.

For scale, from the glibc239 build of #10346: the from-source, stripped cryptography extension is 4.6 MiB, the stripped wheel would be 11 MiB, so this saves about 6 MiB unpacked and about 2 MiB compressed per binary, on top of the roughly 40 MiB the stripping and the botocore trimming already save.

The stripping of the debug symbols and the trimming of the botocore models from #10346 live in the shared PyInstaller spec, so they already apply to the glibc243 binaries (and to macOS, FreeBSD and Windows for the botocore part); the first release build will show it.

Note for review: the new step is tied to the binary matrix entries, which the reduced pull request matrix does not have, so it first runs on the master push after merging, and the bundle check runs on the next tag.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.88%. Comparing base (9f3f692) to head (7c018c7).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #10347   +/-   ##
=======================================
  Coverage   87.88%   87.88%           
=======================================
  Files         103      103           
  Lines       18878    18878           
  Branches     2916     2916           
=======================================
  Hits        16590    16590           
  Misses       1586     1586           
  Partials      702      702           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.