Merge remote-tracking branch 'origin/ni/i10-js-island-requires' into ni/i11-cross-heap-gc

tests/harness/lsan.supp

@@ -28,3 +28,12 @@ leak:PEM_ASN1_read_bio
 # The certificates' lazily decoded keys, cached in them when a root store
 # is built.
 leak:node::crypto::NewRootCertStore
+# The same policy covers OpenSSL's own default-verify-path store, which a
+# TLS context created inside an island loads on its own: undici needs TLS
+# for the builtin classes it backs (Headers, Request, Response), and OpenSSL
+# then parses the system CA bundle through PEM/X509 with no node::crypto
+# frame in the stack, so the entries above cannot match. That state is
+# likewise freed only by OPENSSL_cleanup at exit, which NI-7c keeps off, so
+# it is named here by OpenSSL's allocator entry points instead.
+leak:CRYPTO_malloc
+leak:CRYPTO_zalloc