Remove weak or unneeded ciphers from OpenSSL

OpenSSL defaults to enabling pretty much every cipher and protocol
created since 1990 regardless of the security of the given cipher or
protocol. This commit updates the OpenSSL configuration to disable
ciphers and protocols that don't need to be enabled.

SSLv2 and SSLv3

Both SSLv2 and SSLv3 have known weaknesses and are deprecated.

SEED was developed in South Korea as a response to US export
restrictions on strong ciphers but never gained widespread use. Enabling
this cipher provides no value for our use cases.

Single DES has been broken outright and should not be used in any
situation.

Triple DES has very poor performance, and  has long been considered a
weak cipher. It is widely considered obsolete.

MDC2 is a hashing function based on DES; disabling DES also disables
MDC2.

GOST is a Russian developed algorithm that was created in response to
the American DES cipher. As of 2011 weaknesses have been discovered in
the algorithm that bring the safety of GOST into question.

IDEA was created as a replacement for DES but has a number of flaws,
such as having weak keys and poor performance characteristics compared
to more modern algorithms.

RC2 has long been considered completely broken and has no value on
modern systems.

Cryptanalysis of RC4 continues to find more weaknesses and should not be
used in modern systems.

The use of preshared keys for key exchange in any real world environment
is utterly insane; if people want to use that then they should probably
build their own version of OpenSSL.

SRP is in about the same position as PSK for our use cases; there's no
really reasonable use of SRP with Puppet and SRP has been vulnerable to
DoS attacks (CVE-2014-5139). It provides zero value and should be
removed. SRP was added in OpenSSL 1.0.1, but if we upgrade to that
version then it'll automatically be disabled at that point, and will be
ignored till then.

This results in the following cipher suite using OpenSSL 1.0.1n:

          0xC0,0x14 - ECDHE-RSA-AES256-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
          0xC0,0x0A - ECDHE-ECDSA-AES256-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
          0x00,0x39 - DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
          0x00,0x38 - DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
          0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
          0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(256) Mac=SHA1
          0xC0,0x0F - ECDH-RSA-AES256-SHA     SSLv3 Kx=ECDH/RSA Au=ECDH Enc=AES(256)  Mac=SHA1
          0xC0,0x05 - ECDH-ECDSA-AES256-SHA   SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256)  Mac=SHA1
          0x00,0x35 - AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
          0x00,0x84 - CAMELLIA256-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA1
          0xC0,0x13 - ECDHE-RSA-AES128-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
          0xC0,0x09 - ECDHE-ECDSA-AES128-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
          0x00,0x33 - DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
          0x00,0x32 - DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
          0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1
          0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(128) Mac=SHA1
          0xC0,0x0E - ECDH-RSA-AES128-SHA     SSLv3 Kx=ECDH/RSA Au=ECDH Enc=AES(128)  Mac=SHA1
          0xC0,0x04 - ECDH-ECDSA-AES128-SHA   SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128)  Mac=SHA1
          0x00,0x2F - AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
          0x00,0x41 - CAMELLIA128-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1