Check TLS state before requesting SASL EXTERNAL for outgoing s2s connections

Make sure a remote server can't circumvent "s2s_use_starttls: required" by offering `SASL EXTERNAL` authentication over a non-TLS connection.