Add tunables for TLS versions allowed and whether to check CRLs

The default is to only allow TLS 1.2 and to check the CRL of any client
certificates.

This addresses some of the concerns in basho/riak#433