Allow disabling "vendored" feature for openssl-sys

[kpcyrd]

I've noticed cargo-crev pulls in openssl-src, which means it won't link to the system openssl and needs to do security updates on its own in case of an openssl security update.

Right now it's a hard dependency, it'd be neat if this would be a feature that I can disable (having the feature on by default is fine).

Possibly related to #372

[dpc]

👍 Do you mind pushing a PR through?