[nanvix] E: Drop -lssl -lcrypto -lffi from python.elf LIBS

[esaurez]

Summary

After the Phase 3b libffi unbundling (esaurez/cpython#14) and Phase 3b OpenSSL unbundling (esaurez/cpython#15) shipped, libssl / libcrypto / libffi are loaded at runtime via per-module .so DT_NEEDED chains:

_ssl.cpython-312.so      → DT_NEEDED libssl.so, libcrypto.so
_hashlib.cpython-312.so  → DT_NEEDED libcrypto.so
_ctypes.cpython-312.so   → DT_NEEDED libffi.so

python.elf no longer needs to reference these libraries directly. Leaving -lssl -lcrypto -lffi in Makefile.nanvix's LIBS env produced three unneeded DT_NEEDED entries on python.elf itself:

$ readelf -d python.elf | grep NEEDED
  0x00000001 (NEEDED)  Shared library: [libssl.so]
  0x00000001 (NEEDED)  Shared library: [libcrypto.so]
  0x00000001 (NEEDED)  Shared library: [libffi.so]

Every Python startup loaded all three .so files even if no script ever imported ssl / hashlib / ctypes — pure waste. Worse: these were the only DT_NEEDED entries on python.elf, so eliminating them returns the binary to a pure-static layout matching the intent.

After this PR

$ readelf -d python.elf | grep -E 'NEEDED|RUNPATH'
  (empty — pure static)

Runtime behaviour unchanged: the per-module .so files still pull in the .so chains when they're imported. No size change in python.elf itself (the flags resolved to .so entries, not bundled .a content).

Dependencies

• esaurez/cpython#14 — _ctypes via DT_NEEDED libffi.so. Must ship first so the libffi consumers are wired up correctly.
• esaurez/cpython#15 — _ssl / _hashlib via DT_NEEDED libcrypto.so + libssl.so. Must ship first.

This PR stacks on cpython#15.

Related followup (not in this PR)

Phase 2 unbundling (_decimal, pyexpat, _elementtree, _sha2 — the cpython-bundled libs) hit a hidden-visibility blocker during exploration. The bundled libraries' headers (mpdecimal.h, expat headers, HACL headers) use _Pragma("GCC visibility push(hidden)") to make all public symbols STV_HIDDEN. The MODLIBS-piggyback architecture is correct in principle but the hidden symbols don't end up in python.elf's .dynsym even with --export-dynamic. The recommended path forward is objcopy --globalize-symbols post-build, documented in nanvix-todo/cpython-phase2-bundled-libs-hidden-visibility-blocker.md.