security/softhsm2: strip botan2 option

and unconditionally build with OpenSSL, which has been default
already. botan-2 has been EOL for many months; the original softhsm2
software doesn't support botan-3 and botan-2 has been EOL, upstream
issues about botan-3 haven't been tended to in three years.

softhsm2 is the last user of botan2 in our tree does not require it.

While here, simplify and rearrange Makefile to use canonical
item order. portclippy and portlint -C come up clean now.
I did not run portfmt which would damage indentation.

I've attempted to get the test suite running, and it's as simple
as TEST_TARGET=check, but the cryptotest fails on desKey(56) related
matter (probably harmless to patch out) and p11tests also fail for
reasons I haven't investigated, so I'm not adding this.

Approved by: portmgr@ (blanket)