Make default_method mostly compile-time

Document thread-safety issues

Cherry-pick from 076fc555

 but
keeps the RSA_null method.

Reviewed-by: Geoff Thorpe <geoff@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3146)