ci: bump OpenSSL Chocolatey pin to 4.0.2

[kinyoklion]

Unbreaks every Windows CI job by pinning the OpenSSL Chocolatey package to a version whose installer still exists upstream.

• All Windows jobs on main (client-sdk, server-sdk, redis, dynamodb, otel, cmake-integration) have failed since 2026-08-26 in install-openssl.
• choco install openssl --version 4.0.1 downloads https://slproweb.com/download/Win64OpenSSL-4_0_1.exe, which now returns 404; slproweb only hosts the current installer.
• Bumps the pin 4.0.1 → 4.0.2 (current Chocolatey latest; its installer URL returns 200).

Implementation details

Root cause: the pin in .github/actions/install-openssl/action.yml points at a Chocolatey package whose install script fetches a fixed slproweb URL. slproweb deletes installers for superseded versions, so any pin breaks as soon as a new OpenSSL release ships — this is the fourth such bump (#481, #523, #551).

Verification: Win64OpenSSL-4_0_1.exe → 404, Win64OpenSSL-4_0_2.exe → 200; Chocolatey's IsLatestVersion for openssl is 4.0.2.

Not in scope: making this durable. Options if we want to stop the recurrence — drop the --version flag so Chocolatey always installs latest, or install OpenSSL via vcpkg instead of Chocolatey.

Link to Devin session: https://app.devin.ai/sessions/5abfb857e1814bcfb10a862dbb43438f
Open in Devin Desktop: https://app.devin.ai/desktop/session/5abfb857e1814bcfb10a862dbb43438f?variant=devin
Requested by: @kinyoklion

---

Note

Overview
Restores failing Windows CI by updating the Chocolatey OpenSSL version pin in install-openssl from 4.0.1 to 4.0.2.

The previous pin caused install-openssl to fail because the slproweb installer URL for 4.0.1 now returns 404; 4.0.2’s installer is still available. Linux and macOS steps are unchanged—only the Windows choco install line is updated.

^{Reviewed by Cursor Bugbot for commit 2132b4b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring