[PATCH] add ssl_protocols configuration option

The attached patches add an ssl_protocols configuration option which
control which versions of SSL or TLS the server will use.  The syntax is
similar to Apache's SSLProtocols directive, except that the list is
colon-separated instead of whitespace-separated, although that is easy
to change if it proves unpopular.

Summary of the patch:

 - In src/backend/libpq/be-secure.c:
   - Add an SSLProtocols variable for the option.
   - Add a function, parse_SSL_protocols(), that parses an ssl_protocols
     string and returns a bitmask suitable for SSL_CTX_set_options().
   - Change initialize_SSL() to call parse_SSL_protocols() and pass the
     result to SSL_CTX_set_options().
 - In src/backend/utils/misc/guc.c:
   - Add an extern declaration for SSLProtocols.
   - Add an entry in the ConfigureNamesString array for the
     ssl_protocols option.
 - In src/backend/utils/misc/postgresql.conf.sample:
   - Add a sample ssl_protocols line.
 - In doc/src/sgml/config.sgml:
   - Document the ssl_protocols option.

The file names are slightly different in 9.5, since be-secure.c was
split in two and the declaration was moved into libpq.h.

The default is "ALL:-SSLv2" in 9.0-9.3 and "ALL:-SSL" in 9.4 and up.
This corresponds to the current hardcoded values, so the default
behavior is unchanged, but the admin now has the option to select a
different settings, e.g. if a serious vulnerability is found in TLS 1.0.