socket_connect_prepare(): refuse to establish TLS connection if TLS-banned.

This will fix endless re-connections to a single host when the initial
connection failed and it is being retried with TLS: the old code was instead
clearing the TLS flag silently, thereby defeating the retry logic from upper
layers and creating the loop.