Use TLSv1 again, but with no extensions.
Use TLSv1 again, but with no extensions.

In commit 3bee59cd8c4fd6dc38bc2c7d5edb9b5795509fca ("Use SSLv3 not TLSv1")
we switched to SSLv3 to avoid problems with VPN servers (or firewalls)
which reject extensions in ClientHello. Another user now reports that
using SSLv3 is failing, and he needs to use TLSv1.

Testing confirms that the originally problematic server *does* work with
TLSv1, as long as we disable the session ticket extension. So that makes
everyone happy... for now, until a new extension is invented and enabled
by default, and we have to block that too.  It's a shame that there's no
SSL_OP_NO_EXTENSIONS which would turn them *all* off.

Signed-off-by: David Woodhouse <b460d66aaf00c296a3db1c1d9eeafc081d5f7d70@intel.com>

lins05/openconnect,liiir1985/openconnect,matlockx/openconnect,sihde/openconnect,liiir1985/openconnect,liiir1985/openconnect,lins05/openconnect,atyndall/openconnect,mveplus/openconnect-client,mdutton3/OpenConnect,certik/openconnect,mveplus/openconnect-client,nmav/openconnect-mine,neshema/openconnect,nmav/openconnect-mine,mtmiller/openconnect,matlockx/openconnect,certik/openconnect,neshema/openconnect,chadcatlett/openconnect,mdutton3/OpenConnect,cernekee/openconnect,lins05/openconnect,cernekee/openconnect,mveplus/openconnect-client,brandt/openconnect,chadcatlett/openconnect,mtmiller/openconnect,atyndall/openconnect,nmav/openconnect-mine,don-johnny/openconnect,don-johnny/openconnect,neshema/openconnect,liiir1985/openconnect,matlockx/openconnect,mveplus/openconnect-client,chadcatlett/openconnect,brandt/openconnect,sihde/openconnect,don-johnny/openconnect,nmav/openconnect-mine,chadcatlett/openconnect,atyndall/openconnect,brandt/openconnect,sihde/openconnect,mtmiller/openconnect,cernekee/openconnect,cernekee/openconnect,atyndall/openconnect,certik/openconnect,matlockx/openconnect,lins05/openconnect,mdutton3/OpenConnect,mtmiller/openconnect,neshema/openconnect,brandt/openconnect,don-johnny/openconnect