Support downgrade protection

[bifurcation]

Two halves to this:

• Send the supported_versions and supported_ciphersuites extensions
• When initializing a group, verify that the chosen version/suite is the highest supported