SSL: GUC option to prefer server cipher order

By default OpenSSL (and SSL/TLS in general) lets client cipher
order take priority.  This is OK for browsers where the ciphers
were tuned, but few Postgres client libraries make cipher order
configurable.  So it makes sense to make cipher order in
postgresql.conf take priority over client defaults.

This patch adds setting 'ssl_prefer_server_ciphers' which can be
turned on so that server cipher order is preferred.

The setting SSL_OP_CIPHER_SERVER_PREFERENCE appeared in
OpenSSL 0.9.7 (31 Dec 2002), not sure if #ifdef is required
for conditional compilation.
SSL: Support ECDH key excange.

This sets up ECDH key exchange, when compiling against OpenSSL
that supports EC.  Then ECDHE-RSA and ECDHE-ECDSA ciphersuites
can be used for SSL connections.  Latter one means that EC keys
are now usable.

The reason for EC key exchange is that it's faster than DHE
and it allows to go to higher security levels where RSA will
be horribly slow.

Quick test with single-threaded client connecting repeatedly
to server on same machine, then closes connection.  Measured
is connections-per-second.

  Key             DHE     ECDHE
  RSA-1024        177.5   278.1   (x 1.56)
  RSA-2048        140.5   191.1   (x 1.36)
  RSA-4096        59.5    67.3    (x 1.13)
  ECDSA-256               280.7   (~ RSA-3072)
  ECDSA-384               128.9   (~ RSA-7680)

There is also new GUC option - ssl_ecdh_curve - that specifies
curve name used for ECDH.  It defaults to "prime256v1", which
is the most common curve in use in HTTPS.  According to NIST
should be securitywise similar to ~3072 bit RSA/DH.
(http://www.keylength.com / NIST Recommendations).

Other commonly-implemented curves are secp384r1 and secp521r1
(OpenSSL names).  The rest are not recommended as EC curves
needed to be exchanged by name and need to be explicitly
supprted by both client and server.  TLS does have free-form
curve exchange, but few client libraries implement that,
at least OpenSSL does not.

Full list can be seen with "openssl ecparam -list_curves".

It does not tune ECDH curve with key size automatically,
like DHE does.  The reason is the curve naming situation.
SSL: Better default ciphersuite

Change the default ciphersuite to

	HIGH:!aNULL

instead of old

	DEFAULT:!LOW:!EXP:!MD5:@STRENGTH

[ Note - DEFAULT is documented as shortcut for "ALL:!aNULL:!eNULL" ]

Main goal is to leave ciphersuite maintenance to OpenSSL guys
and give correct impression to Postgres admins what it is about.

New value will remove all suites with RC4 and SEED from ciphersuite list.
If OpenSSL is compiled with support for SSL2 it will include following
suite: DES-CBC3-MD5 (3DES + HMAC-MD5), usable only for SSL2 connections.

Tested with OpenSSL 0.9.7 - 1.0.2, using "openssl ciphers -v ..." command.

Values used
-----------

HIGH:
  Contains only secure and well-researched algorithms.

!aNULL
  Needed to disable suites that do not authenticate server.
  DEFAULT includes !aNULL by default.

Values not used
---------------

!MD5
  This affects only one suite: DES-CBC3-MD5, which is available only
  for SSL2 connections.  So it would only pollute the default value.

@STRENGTH
  The HIGH/DEFAULT suite lists are already sorted by humans,
  it's unlikely that mechanical sort would improve things.
  Also the existense of this value in old list is rather
  dubious, as server cipher order was never respected anyway.