Improved 9.2.2 TLS Restrictions

Made cipher restrictions TLS1.2 specific.

Removed all "such as" examples and replaced with references to RFC

Made DHE or ECDHE the only acceptable key exchanges as I could not find
precise definition of an ephemeral key exchange. None DHE or ECDHE ciphers
will have to be TLS 1.3 or rely on 9.2.3

Moved h1 backwards compatibility to 9.2.3 section.  Weak ciphers can
only be offered in a retry without h2.  If a client advertises a cipher
with h2, it must not subsequently reject it.