Use better default TLS settings

[bmillwood]

Commit message:

On versions of tls pre-2.0.6, the default Supported had an empty list of supportedCiphers. Per discussion on their issue, it seems like everyone was overriding it to ciphersuite_default anyway, hence the change at version 2.0.6 to make that default. But we're not doing that here! Luckily, the default for TLSSettings does do that override, so we can use that to get the right behaviour regardless of tls version.

I noticed this because all my https requests were failing with this message:

(InternalException (HandshakeFailed (Error_Protocol ("expecting server hello, got alert : [(AlertLevel_Fatal,IllegalParameter)]",True,HandshakeFailure)))))

With this change, they succeed. (But they also succeed with the latest version of tls, which makes this difficult to write a regression test for.)

[bmillwood]

I didn't think of this while I was creating this PR, but I guess this probably also means you can put the crypton-connection constraint lower bound back down to 0.3, since this code will also work before that field was added.

(Originally it was >= 0.2.2, but that version doesn't exist.)

[mrkkrp]

Thanks! Could you add the corresponding change in the lower bound of crypton-connection and a changelog entry?

[bmillwood]

Thanks! Could you add the corresponding change in the lower bound of crypton-connection and a changelog entry?

Done. I think the PVP only requires this to be 3.14.3.1, but it looks like you don't use four-component versions? Happy to tweak it to that if you want.

[mrkkrp]

Thanks!