Force strong TLS cipher suites in rustup-init.sh
Force strong TLS cipher suites in rustup-init.sh

Force curl and wget to use strong TLS cipher suites if supported by
local tools. If RUSTUP_TLS_CIPHERSUITES variable is set by user then
use it. Closes #2284.

curl and wget TLS backends supported for strong TLS cipher suites:
GnuTLS, OpenSSL, LibreSSL and BoringSSL. Other backends
(NSS, WolfSSL, etc.) fall back to prior behavior but can also
handle user-specified cipher suites in any syntax required
(syntax is not checked by script).

curl and wget (if support is detected) will use the same strong
TLS 1.2-1.3 cipher suite as Firefox 68 ESR with all weak cipher
suites disabled using about:config. Sequence of all 9 cipher suites
for OpenSSL is identical to Firefox (slightly different for GnuTLS).

DHE is excluded from TLS 1.2 because servers often use bad
DH params (see RFC 7919).

GnuTLS priority string produces:

TLS_AES_128_GCM_SHA256                 0x13, 0x01    TLS1.3
TLS_CHACHA20_POLY1305_SHA256           0x13, 0x03    TLS1.3
TLS_AES_256_GCM_SHA384                 0x13, 0x02    TLS1.3
TLS_ECDHE_ECDSA_AES_128_GCM_SHA256     0xc0, 0x2b    TLS1.2
TLS_ECDHE_ECDSA_CHACHA20_POLY1305      0xcc, 0xa9    TLS1.2
TLS_ECDHE_ECDSA_AES_256_GCM_SHA384     0xc0, 0x2c    TLS1.2
TLS_ECDHE_RSA_AES_128_GCM_SHA256       0xc0, 0x2f    TLS1.2
TLS_ECDHE_RSA_CHACHA20_POLY1305        0xcc, 0xa8    TLS1.2
TLS_ECDHE_RSA_AES_256_GCM_SHA384       0xc0, 0x30    TLS1.2

GnuTLS priority string could be hardened more but it isn't forgiving
of unknown/unsupported values, so the bare minimum was specified.

inejge/rustup.rs,rust-lang/rustup,rust-lang/rustup,rust-lang/rustup,inejge/rustup.rs,inejge/rustup.rs,nodakai/rustup.rs,rust-lang/rustup,nodakai/rustup.rs,nodakai/rustup.rs,nodakai/rustup.rs,rust-lang/rustup,nodakai/rustup.rs,inejge/rustup.rs,inejge/rustup.rs