Revise how TLS connections are negotiated.

Now we explicitly enable TLSv1.2, TLSv1.1 and TLSv1.0 where they are supported.
We continue to perform only one fallback, to SSLv3.

In a follow-up we can make TLS configurations user-accessible, and allow the
application to limit which versions are used.
This is a backwards-incompatible API change. Is it possible to coerce this value from the String in a deprecated constructor?