More ciphers

this cleans up the `ciphersuite` type and reduces the non-exhaustive pattern matches (by 4, now down to 4 :)

We also now support `_SHA256` ciphers when using tls1_2 (integrated into interop testing)!

`ciphersuite` is now a polyvar only containing those ciphersuites which we actually implement.

And also we provide a `?pfs_only` configuration parameter to easily setup server/client which should only use ciphersuites which support perfect forward secrecy (DHE kex).