Exclude HPKE targets from Tink when building with OpenSSL.

 * Introduce a parameter 'TAGS' to CMake build rules, and the specific tag "exclude_if_openssl"; adding this tag will result in skipping the target if `TINK_USE_SYSTEM_OPENSSL=ON`.
 * Tag with "exclude_if_openssl" all the targets in `cc/hybrid/internal`, `hpke_config(|_test)` and tentatively hybrid_key_templates_test` since it depends on excluded targets.

PiperOrigin-RevId: 423836764
diff --git a/cmake/TinkBuildRules.cmake b/cmake/TinkBuildRules.cmake
index 2937106..d71abc4 100644
--- a/cmake/TinkBuildRules.cmake
+++ b/cmake/TinkBuildRules.cmake
@@ -55,6 +55,8 @@
 
 set(TINK_IDE_FOLDER "Tink")
 
+set(TINK_TARGET_EXCLUDE_IF_OPENSSL "exclude_if_openssl")
+
 # Declare the beginning of a new Tink library namespace.
 #
 # As a rule of thumb, every CMakeLists.txt should be a different module, named
@@ -96,7 +98,7 @@
   cmake_parse_arguments(PARSE_ARGV 0 tink_cc_library
     "PUBLIC"
     "NAME"
-    "SRCS;DEPS"
+    "SRCS;DEPS;TAGS"
   )
 
   if (NOT DEFINED TINK_MODULE)
@@ -104,6 +106,14 @@
             "TINK_MODULE not defined, perhaps you are missing a tink_module() statement?")
   endif()
 
+  # Check if this target must be skipped. Currently the only reason for this to
+  # happen is incompatibility with OpenSSL, when used.
+  foreach(_tink_cc_library_tag ${tink_cc_library_TAGS})
+    if (${_tink_cc_library_tag} STREQUAL ${TINK_TARGET_EXCLUDE_IF_OPENSSL} AND TINK_USE_SYSTEM_OPENSSL)
+      return()
+    endif()
+  endforeach()
+
   # We replace :: with __ in targets, because :: may not appear in target names.
   # However, the module name should still span multiple name spaces.
   STRING(REPLACE "::" "__" _ESCAPED_TINK_MODULE ${TINK_MODULE})
@@ -161,7 +171,7 @@
   cmake_parse_arguments(PARSE_ARGV 0 tink_cc_test
     ""
     "NAME"
-    "SRCS;DEPS;DATA"
+    "SRCS;DEPS;DATA;TAGS"
   )
 
   if (NOT TINK_BUILD_TESTS)
@@ -172,6 +182,14 @@
     message(FATAL_ERROR "TINK_MODULE not defined")
   endif()
 
+  # Check if this target must be skipped. Currently the only reason for this to
+  # happen is incompatibility with OpenSSL, when used.
+  foreach(_tink_cc_test_tag ${tink_cc_test_TAGS})
+    if (${_tink_cc_test_tag} STREQUAL ${TINK_TARGET_EXCLUDE_IF_OPENSSL} AND TINK_USE_SYSTEM_OPENSSL)
+      return()
+    endif()
+  endforeach()
+
   # We replace :: with __ in targets, because :: may not appear in target names.
   # However, the module name should still span multiple name spaces.
   STRING(REPLACE "::" "__" _ESCAPED_TINK_MODULE ${TINK_MODULE})