cleanup: Remove unused dependencies

[maddeleine]

Resolved issues:

Resolves #3236

Description of changes:

Removes two unused dependencies:

• GnuTLS 3.5.5 was originally added as a dependency to run an SSLv3 integ test in our old "integ v1 tests". However, we added an integration test for SSLv3 in test: Adds SSLv3 integ test #4372 using Openssl 1.0.2, therefore, our dependency on GnuTLS 3.5.5 can be removed. (GnuTLS 3.7 is still being used.)
• Additionally, we aren't currently using Openssl 0.9.8 for any testing. It looks like this dependency was originally added to test our ability to upgrade an SSLv2 client hello to TLS1.0 I don't think that integ test exists in our current integ framework, however, I don't anticipate anyone spending the time to add that test back in ever.

Testing:

I think if this passes CI we're good 🤔

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[dougch]

GnuTLS 3.7 is also what's we're using in the (slightly out of date) nix devShell as well.

[dougch]

Good riddance.

[lrstewart]

I don't think that integ test exists in our current integ framework, however, I don't anticipate anyone spending the time to add that test back in ever.

We still support that feature, so why not? I think that's another miss of the integv2 migration, not a deliberate removal. Which means we should add that test back.

[maddeleine]

I don't think that integ test exists in our current integ framework, however, I don't anticipate anyone spending the time to add that test back in ever.

We still support that feature, so why not? I think that's another miss of the integv2 migration, not a deliberate removal. Which means we should add that test back.

We technically don't need Openssl 0.9.8 to send an SSLv2 client hello. Openssl 1.0.2 will send one, but we currently compile with the -no-ssl2 option. I'd rather change how we compile Openssl 1.0.2 and use that for the sslv2 test than use Openssl 0.9.8 to do this, but if you don't like that idea I can change this PR to only removing gnutls.

[lrstewart]

We technically don't need Openssl 0.9.8 to send an SSLv2 client hello. Openssl 1.0.2 will send one, but we currently compile with the -no-ssl2 option. I'd rather change how we compile Openssl 1.0.2 and use that for the sslv2 test than use Openssl 0.9.8 to do this, but if you don't like that idea I can change this PR to only removing gnutls.

Nope, sounds reasonable. But can you open an issue for the lost sslv2 client hello test before it's forgotten again?

[maddeleine]

Opened #4419 to track missing sslv2 test.