As pointed out by several people, r273114 was incorrect: it unconditionally
disabled everything except TLS 1.0.  Replace it with a more carefully
wrought patch:

 - Switch the default for SSLv3 from on to off
 - Add environment variables to control TLS 1.1 and 1.2
 - In verbose mode, report which version is used
 - Update the man page to reflect these changes.

MFC after:	1 week


git-svn-id: svn+ssh://svn.freebsd.org/base/head@273124 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f