(PUP-3467) Update webrick ciphersuites to match passenger

Previously, puppet's webrick server did not specify which ciphersuites
it would accept. Depending on the ruby and openssl, the default set of
ciphersuites is:

    $ ruby -ropenssl -e 'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]'
    ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

Note that "ALL:!ADH" does not exclude AECDH, and the default param
string includes "LOW", e.g. DES-CBC-SHA.

This commit updates the webrick ciphersuites to match the value used
in passenger in commit 204b2974b. The resulting ciphersuites are:

    [["DHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA256", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["AES128-SHA", "TLSv1/SSLv3", 128, 128]]
(PUP-3467) Reject SSLv3 when initiating SSL connections

Previously, when puppet initiated SSL connections, e.g. puppet agent,
puppet module, etc, it could downgrade to SSLv3.

This commit ensures puppet will not downgrade to SSLv3 by setting the
`OpenSSL::SSL::OP_NO_SSLv3` bit. However, unlike SSLv2, we cannot remove
SSLv3 ciphersuites, since they are the same ones used in TLSv1. From the
openssl ciphers man page, "The TLSv1.0 ciphers are flagged with SSLv3".

[1] https://www.openssl.org/docs/ssl/SSL_CIPHER_get_name.html