sinksmtp: clarify and improve a bit of our TLS support

I've discovered and now document that Go's TLS support is not audited
and should not be trusted with anything important because, eg, it may
leak your private keys. As such the documentation now says 'you should
only really use this with self-signed certificates'.

It also turns out that messages about unsupported SSLv2 handshakes may
be coming from clients that support TLS but start out with a SSLv2
handshake. As a result sinksmtp now gives clients two chances to do
TLS, so that after the SSLv2 handshake fails clients can retry with a
TLS-only one.

(I have no idea if any clients will actually do this, but now if they're
smart enough to do it we'll support it.)