Feature gate openssl usage in generated CLI

[wafflespeanut]

Currently, we're using openssl for setting root certs and client verification (optionally). Users should be able to opt out of this feature if they don't need it. It's sensible to add a feature gate, say custom-tls for enabling this option.