report a more useful error than undefined when trying to use HashSHA256 in SSL3 mode.
add a helper to check if a cipher is allowed to be used with some version
make the error message a bit more precise related to which side it happen.
add some comment about the expected values.
Fix version usage related to downgrading

* properly chose the highest version supported on the server, instead of
  chosing the first that match.
* use the client version in the RSA client exchange instead of the negotiated version
* delay hashing mechanism to serverHello message so that choosing MD5SHA1 or SHA256
  is done after the server chose the version.
extend tests to allow for version downgrading by server
add support for pem 0.2.x