On debian there are well defined valgrind ignores. This means that we can say that openssl is pure and we don't need our own version. Also add static analyzers to CI.