Suppress OpenSSL's default-verify-path store in the sanitized lane

6883-node-island-builtin-handles builds a Headers inside an island, undici
loads node:tls for the builtin classes it backs, and OpenSSL parses the
system CA bundle through PEM/X509. That state is freed only by
OPENSSL_cleanup at exit, which NI-7c keeps off, and the stacks carry no
node::crypto frame, so the existing entries cannot match. Name OpenSSL's
allocator entry points, as the file already does for the rest of libnode's
process-lifetime state.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/harness/lsan.supp

@@ -23,3 +23,12 @@ leak:node::crypto::LoadCertsFromBIO
 # The certificates' lazily decoded keys, cached in them when a root store
 # is built.
 leak:node::crypto::NewRootCertStore
+# The same policy covers OpenSSL's own default-verify-path store, which a
+# TLS context created inside an island loads on its own: undici needs TLS
+# for the builtin classes it backs (Headers, Request, Response), and OpenSSL
+# then parses the system CA bundle through PEM/X509 with no node::crypto
+# frame in the stack, so the entries above cannot match. That state is
+# likewise freed only by OPENSSL_cleanup at exit, which NI-7c keeps off, so
+# it is named here by OpenSSL's allocator entry points instead.
+leak:CRYPTO_malloc
+leak:CRYPTO_zalloc