(PUP-3467) Reject SSLv3 connections in webrick

Webrick will now reject SSLv3 connections. If an SSL client tries to
connection with SSLv3, webrick+openssl will issue an sslv3 alert
handshake failure.
(PUP-3467) Update webrick ciphersuites to match passenger

Previously, puppet's webrick server did not specify which ciphersuites
it would accept. Depending on the ruby and openssl, the default set of
ciphersuites is:

    $ ruby -ropenssl -e 'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]'
    ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

Note that "ALL:!ADH" does not exclude AECDH, and the default param
string includes "LOW", e.g. DES-CBC-SHA.

This commit updates the webrick ciphersuites to match the value used
in passenger in commit 204b2974b. The resulting ciphersuites are:

    [["DHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA256", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["AES128-SHA", "TLSv1/SSLv3", 128, 128]]
(PUP-3467) Reject SSLv3 when initiating SSL connections

Previously, when puppet initiated SSL connections, e.g. puppet agent,
puppet module, etc, it could downgrade to SSLv3.

This commit ensures puppet will not downgrade to SSLv3 by setting the
`OpenSSL::SSL::OP_NO_SSLv3` bit. However, unlike SSLv2, we cannot remove
SSLv3 ciphersuites, since they are the same ones used in TLSv1. From the
openssl ciphers man page, "The TLSv1.0 ciphers are flagged with SSLv3".

[1] https://www.openssl.org/docs/ssl/SSL_CIPHER_get_name.html
Merge pull request #3215 from joshcooper/ticket/stable/PUP-3467-reject-sslv3

(PUP-3467) Reject SSLv3