Explicitly remove support of SSLv2/3
    
    It was possible to set tls_version_min/max to 'ssl2' or 'ssl3',
    even though newer versions of NSS will fail to set this as a valid
    TLS version. This patch explicitly checks for deprecated TLS versions
    prior to creating a TLS connection.
    
    Also, we don't allow tls_version_min/max to be set to a random
    string anymore.
    
    https://fedorahosted.org/freeipa/ticket/6607
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    Reviewed-By: Tomas Krizek <tkrizek@redhat.com>