crypto: don't build hardware engines

Compile out hardware engines.

`ENGINE_load_builtin_engines()` is not called in v0.10 so this does
not represent a known security vulnerability.

Backport of
https://github.com/nodejs/node-private/pull/58

PR-URL: https://github.com/nodejs/node-private/pull/68
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

deps/openssl/openssl.gyp

@@ -1099,6 +1099,11 @@
       # Microsoft's IIS, which seems to be ignoring whole ClientHello after
       # seeing this extension.
       'OPENSSL_NO_HEARTBEATS',
+
+      # Compile out hardware engines.  Most are stubs that dynamically load
+      # the real driver but that poses a security liability when an attacker
+      # is able to create a malicious DLL in one of the default search paths.
+      'OPENSSL_NO_HW',
     ],
     'direct_dependent_settings': {
       'defines': [