Change Crypto Spec in accordance to bettercrypto.org

The current puppet crypto spec is 5yrs old (talked to the original author). I've adapted it to something sane and have taken the current recommendations for it by the bettercrypto(.org) project.

amended [during a discussion on GitHub (https://github.com/puppetlabs/puppet/pull/2494) I was asked to include the reasoning I gave into the commit message ]:

TL;DR - this cipherspec will fall back to AES-CBC in case a server or client has an ancient release of openssl and will provide strong cryptographic security for installations shipping current OpenSSL

```
@haus
> Can you put some more detail into your commit message as to why you selected the ciphers you did and from where?

Yes. It's in our paper. :)

I've contributed large parts of the cipher spec as well as the Apache configuration. If you have specific questions, just ask. We have also talked to browser vendors such as mozilla regarding this issue, they not always agree with our decisions, and some of these recommendations might change shortly due to e.g. camellia becoming obsolete for browsers as soon as Firefox removes support - which they assured us will be soon. That does not really matter for OpenSSL to OpenSSL connections though as with Apache speaking to Ruby clients, both linking to OpenSSL.

> Also, the bettercrypto Apache recommendations have only been tested against Wheezy and Jessie, both of which link against openssl 1.0.1e.

Yes. These should correctly fall back to AES-CBC as well as CAMELLIA-CBC. I'm not aware that OpenSSL 0.9.8 (which was released in 2005, by the way) has any issues with our recommendation. Even so, there have been an abundance of security issues related to versions 0.9.8 up to 1.0.1 and new TLS attacks are appearing almost quarterly (see https://www.openssl.org/news).

>  In particular, removing almost all SSLv3 ciphers worries me for compatibility with those platforms.

I'm not aware of any issues, if so, please tell me.

Besides: it's actually worrying that SSLv3 is still in use. This is an entirely broken protocol.

> Is there a reason to not go with the slightly less aggressive recommendations from mozilla?

Yes. RC4, DSS and a couple of other worrying choices that might be useful for people in china still using browsers on windows xp (which is apparently 60%+ of the online populus) but has zero positive effect on wire security for e.g. automation and orchestration tools such as puppet. Downgrade attacks on TLS are not a miracle to pull off. :)

I've neglected citing why ECDSA is also a bad idea since that's a bit off topic, but DJB recently wrote a nice blog post about that issue, if you're interested: http://blog.cr.yp.to/20140323-ecdsa.html
```