Allow insecure openssl_1_1 (build-time link only)

pkgs/anisette-v3-server/default.nix

@@ -19,6 +19,11 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
+  # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
+  # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
+  # OpenSSL 3). The resulting binary statically links it.
+  permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
   buildInputs = [ zlib openssl_1_1 ];
 
   meta = {