Add configurable TLS profiles for listeners

Add a tls_profile option that controls the minimum TLS version and
allowed cipher suites for STARTTLS/TLS listeners. Profiles align with
the Mozilla SSL Configuration Generator guidelines.

Profiles:
  default      - Go standard library defaults (no explicit constraints)
  modern       - TLS 1.3+ only (Mozilla modern)
  intermediate - TLS 1.2+ with AEAD + ECDHE suites only (Mozilla intermediate)
  legacy       - TLS 1.0+ with all Go cipher suites including insecure ones

smtprelay.ini

@@ -35,6 +35,33 @@
 ;local_cert = smtpd.pem
 ;local_key  = smtpd.key
 
+; TLS PROFILE (STARTTLS / TLS listeners)
+; Controls the minimum TLS version and allowed cipher suites for inbound
+; connections when using listen protocols `starttls://` or `tls://`.
+; Profiles follow the Mozilla SSL Configuration Generator guidelines.
+;
+;   default
+;     Go standard library defaults. Tracks improvements as Go updates
+;     its TLS defaults. Recommended for most deployments.
+;
+;   modern
+;     TLS 1.3+ only. Simplest and most secure, but rejects any client
+;     that cannot negotiate TLS 1.3.
+;     Matches Mozilla "modern" configuration.
+;
+;   intermediate
+;     TLS 1.2+. For TLS 1.2 connections only AEAD ciphers (AES-GCM,
+;     ChaCha20-Poly1305) with ECDHE key exchange are allowed,
+;     providing forward secrecy. TLS 1.3 ciphers are always available.
+;     Matches Mozilla "intermediate" configuration.
+;
+;   legacy
+;     TLS 1.0+ with all cipher suites the Go standard library supports,
+;     including insecure ones (RC4, 3DES). Use only when you must
+;     support very old clients that cannot negotiate TLS 1.2.
+;
+;tls_profile=default
+
 ; Enforce encrypted connection on STARTTLS ports before
 ; accepting mails from client.
 ;local_forcetls = false