gh-158010: Avoid recommending out-of-date OpenSSL in configure doc

Author: zware

Doc/using/configure.rst

@@ -95,8 +95,7 @@ Dependencies to build optional modules are:
      -
      - :mod:`curses`
    * - `OpenSSL <https://openssl-library.org/>`_
-     - | 3.0.18 recommended
-       | (1.1.1 minimum)
+     - [8]_
      - :mod:`ssl`, :mod:`hashlib` [6]_
    * - `SQLite <https://sqlite.org/>`_
      - 3.15.2
@@ -131,6 +130,14 @@ Dependencies to build optional modules are:
    See :option:`--with-builtin-hashlib-hashes` for *forcing* usage of OpenSSL.
 .. [7] See :option:`--with-zlib` for choosing the backend for the
    :mod:`zlib` module.
+.. [8] OpenSSL 1.1.1 is the minimum possible version to build against,
+   but the latest public release of the series has known vulnerabilities.
+   For best compatibility and security it is recommended to always use
+   the latest patch release of a current LTS release series (see the
+   `OpenSSL Roadmap <https://openssl-library.org/roadmap/index.html>`_),
+   or the package provided by your operating system if available.  Other
+   libraries that offer an API compatible with OpenSSL 1.1.1 or later may
+   also be usable, but are not officially supported.
 
 Note that the table does not include all optional modules; in particular,
 platform-specific modules like :mod:`winreg` are not listed here.