Fix NULL derefs, buffer overflow, and i2d contract in EVP/OCSP/X509

[ColtonWilley]

Summary

Harden OpenSSL compatibility layer against NULL pointers, negative lengths,
and buffer overflows across EVP, OCSP, and X509 APIs. Fix DSA SignFinal
write-before-check overflow, add missing i2d_OCSP_RESPONSE allocation path,
and fix unaligned keyUsage access.

Test plan

• Existing CI passes
• OCSP single_get0_status test updated for new -1 return on NULL