saslserv: drop support for DH-AES and DH-BLOWFISH

Both mechanisms have serious design flaws which make them insecure.  To fix the
design flaws would make both mechanisms incompatible with current implementations,
and provide little-to-no gain over using PLAIN in a TLS channel instead.

Thusly, we drop support for them.
update NEWS to reflect removal of DH-AES and DH-BLOWFISH