HTTPCLIENT-1969: Filter out weak cipher suites

[artem-smotrakov]

Please consider a patch for HTTPCLIENT-1969:

• Defined a list of weak algorithms which may be used in a TLS connection. The list is based on the latest settings in modern OpenJDK, see java.security file (EXPORT ciphers are also disabled in modern OpenJDK by default)
• Updated SSLConnectionSocketFactory to filter out weak ciphers if cipher suites are not explicitly set.

Please note that the test passes with latest Java versions even without patching SSLConnectionSocketFactory because latest Java versions disable weak ciphers by default. The filtering mechanism blocks weak ciphers in case older Java versions are used.

[garydgregory]

I like the idea of this patch!

[ok2c]

@artem-smotrakov Please normalize cipher names prior to doing the weak algo matching.

[artem-smotrakov]

Addressed comments from @ok2c

• Use regexp to catch weak cipher suites
• Normalize cipher suites names prior matching
• Added more weak algorithms even them they are not supported by the default JSSE implementation
• Updated tests

Please take a look.

[ok2c]

@artem-smotrakov Almost there. See my comment. Please also squash commits into a single one.

[artem-smotrakov]

Updated the patch:

• Use non-case sensitive regex matching
• Squash commits into a single one

@ok2c Please take a look.

[ok2c]

@artem-smotrakov So much nicer, is it not?

[ok2c]

@artem-smotrakov Would you also be willing to port this change-set to master?

[artem-smotrakov]

To be honest, I am not convinced that regexp is better here, but it's not a big deal to me :) Let's agree to disagree, you have more experience with this project :) Sure, I'll port it to the master branch. Thanks for the review @ok2c !