Disable all renegotiation, resumption options and set safest defaults.

Reason is we want to expose a minimal attack surface on the very complex
TLS protocol and its implementations.

To disable TLS renegotiation and session resumption we need to turn off
the server-side session cache *and* disable session tickets (RFC 5077)
extension, see [1]. In the future we can always selectively re-enable
options in order to gain a performance boost.

[1] https://www.mail-archive.com/openssl-users@openssl.org/msg73185.html

Since we do not care about cross-browser compatibility and web, we also
disable all OpenSSL defaults that help with backwards compatibility.

(cherry picked from commit 2fc52bc965c878ea1859cb7c017a6d228b91215c)