disable softfail by default (in line with documentation)

The documentation in mods-available/eap says that OCSP softfail is disabled by default, which is the more secure option (inability to contact the OCSP server results in auth failure).

However, the code enables it by default, which could easily be insecure if misunderstood. This patch reverses that.