client.SSL: pick TLS-1.2, if supported (nss >= 3.15)