Feature flag to enforce compiling with external boringssl

Would you be willing to add an explicit feature flag that says we're compiling with an external boringssl, or possibly consider removing the vendored boringssl from the [quiche crate](https://docs.rs/crate/quiche/latest/source/deps/boringssl/)?

This came up while we are investigating switching how Fuchsia depends on a fork of the quiche git repository over to the published quiche on crates.io. We review the code whenever we update our vendored dependencies, but we are separately maintaining our boringssl version to stay near tip of tree. The vendored boringssl appears to now be about 7 months out of date.

In order to use an external boringssl, we need to both have the rust feature flag `boringssl-vendored` enabled, as well as having the environment variable `QUICHE_BSSL_PATH` set to point at our boringssl. We have some concerns that if you ever decided to change how how you find the library, say by renaming the environment variable to `QUICHE_BORINGSSL_PATH`, it could be easy to miss in review. I believe this would result in us linking against your vendored version, rather than the one we maintain.

While I doubt you'd actually make this change, it might help us be a bit more resilient if we could have a cargo feature flag to explicitly state we want to use an external boringssl. This is because cargo will complain if we specify a feature flag that no longer exists, as opposed to an environment variable where you'd have to explicitly check if we're using the old environment variable name.

An even more robust way to protect against this scenario would be to remove the vendored boringssl altogether, and instead optionally enable `boringssl-boring-crate` feature flag by default. We could then disable this feature, and guarantee during the vendoring process that we have not pulled in the [boring](https://docs.rs/boring/latest/boring/) crate.

Thanks!

Start by reading the quiche crate's deps/boringssl setup, Cargo feature declarations, and handling of QUICHE_BSSL_PATH and boringssl-vendored. Clarify whether the intended outcome is an explicit external-BoringSSL feature or removal of the vendored copy; done should make the selected dependency path explicit and prevent silent fallback.

Written by the indexing model from the issue text.