fix: add openssl replace_requires to vfx Conan profiles

[aloysbaillet]

Summary

• openssl replace_requires: Conan 2 replaces (not merges) [replace_requires] sections when a child profile defines its own. After openssl was moved to common-wrappers (99175a6) and removed from vfx profiles (d95cc87), the openssl mapping from parent ci_common* profiles was silently lost. Adds explicit openssl/* entries to vfx2024, vfx2025, and vfx2026 profiles.
• ASWF_PYSIDE_CLANG_VERSION: The packages/common/Dockerfile was hardcoding ASWF_PYSIDE_CLANG_VERSION to ASWF_CLANG_VERSION, ignoring the ARG from versions.yaml. This caused PySide to use the wrong clang version.
• Explicit cache mount IDs: Added id=aswf-conan-cache and id=aswf-ccache to BuildKit cache mounts in both the package builder and CI image Dockerfiles for more predictable cache sharing.
• nss version: Corrected nss version from 3.112.0 to 3.101.0 in all vfx profiles and versions.yaml. The nss conanfile detects the version from the system, and the CUDA base image ships nss 3.101.0, not 3.112.0. This was causing Qt builds to fail in both CI and local builds.

Test plan

• CI docker build passes the cpython package build step (openssl fix)
• CI docker build passes the Qt package build step (nss version fix)
• CI docker build passes the PySide package build step (clang version fix)
• Full VFX 2026 pipeline completes without package resolution errors

🤖 Generated with Claude Code