Add a tls_profile option that controls the minimum TLS version and
allowed cipher suites for STARTTLS/TLS listeners. Profiles align with
the Mozilla SSL Configuration Generator guidelines.
Profiles:
default - Go standard library defaults (no explicit constraints)
modern - TLS 1.3+ only (Mozilla modern)
intermediate - TLS 1.2+ with AEAD + ECDHE suites only (Mozilla intermediate)
legacy - TLS 1.0+ with all Go cipher suites including insecure ones
