Cleanup update logic for embedded openssl git tree.

Due to the shallow clone, the existing openssl tree never updates as the
tag we are attempting to move to does not exist in our tree causing the
"git checkout" command to fail the pipeline.

Instead, if the latest blessed version of the upstream (as defined by the
regex we used to decide which openssl version we support) is different than
our local tree, use "git fetch" to grab the new tag and then use "git
checkout" to move our local tree to it.

Tested on:	Way too many trees of openssl in different states

Makefile

@@ -140,10 +140,13 @@ uninstall:
 .openssl.is.fresh: opensslpull
 	true
 opensslpull:
+	upstream=`git ls-remote https://github.com/openssl/openssl | grep -Eo '(openssl-3\.0\.[0-9]+)' | sort -V | tail -n 1` ; \
 	if [ -d openssl -a -d openssl/.git ]; then \
-		cd ./openssl && git checkout `git ls-remote https://github.com/openssl/openssl | grep -Eo '(openssl-3\.0\.[0-9]+)' | sort --version-sort | tail -n 1` && git pull | grep -q "Already up to date." && [ -e ../.openssl.is.fresh ] || touch ../.openssl.is.fresh ; \
+		if [ "$$upstream" != "`cd ./openssl && git describe --exact-match --tags`" ]; then \
+			cd ./openssl && git fetch --depth 1 origin refs/tags/$$upstream:refs/tags/$$upstream && git checkout $$upstream && touch ../.openssl.is.fresh ; \
+		fi \
 	else \
-	git clone --depth 1 -b `git ls-remote https://github.com/openssl/openssl | grep -Eo '(openssl-3\.0\.[0-9]+)' | sort -V | tail -n 1` https://github.com/openssl/openssl ./openssl && cd ./openssl && touch ../.openssl.is.fresh ; \
+		git clone --depth 1 -b $$upstream https://github.com/openssl/openssl ./openssl && cd ./openssl && touch ../.openssl.is.fresh ; \
 	fi
 
 openssl/Makefile: .openssl.is.fresh