cmake: rework NSS and SSL

cmake: rework NSS and SSL

The cmake build should select NSS or CryptoPP consistently with
current autoconf logic, as used in our RHEL builds (-DWITH_NSS),
and the SSL linkage must match (for NSS, -lssl3).

With this change, there is no direct linkage with libssl when NSS
is selected (I still see indirect linkage via libcurl, in turn
via libssh2, looking into that).

With guidance from upstream and downstream, NSS builds are now
selected by default.

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>