sinksmtp: force a minimum of TLS 1.0 on first TLS connection

If an IP hasn't already failed TLS with us once, we try out not accepting
SSLv3 by setting a minimum TLS version of TLS 1.0. I'm doing this to smoke
out clients that are SSLv3 only.

Probably I should also log the SSL version negociated, as that would be
directly useful information.