crypto_openssl: call EVP_EncryptFinal_ex only if needed