Tweak cipher selection to make TLS < 1.2 work with OpenSSL 3.

Taken from Debian:

  https://salsa.debian.org/python-team/packages/mercurial/-/blob/debian/master/debian/patches/openssl_3_cipher_tlsv1.patch

--- a/mercurial/sslutil.py
+++ b/mercurial/sslutil.py
@@ -117,17 +117,17 @@ def _hostsettings(ui, hostname):
     ciphers = ui.config(b'hostsecurity', b'%s:ciphers' % bhostname, ciphers)
 
     # If --insecure is used, we allow the use of TLS 1.0 despite config options.
     # We always print a "connection security to %s is disabled..." message when
     # --insecure is used. So no need to print anything more here.
     if ui.insecureconnections:
         minimumprotocol = b'tls1.0'
         if not ciphers:
-            ciphers = b'DEFAULT'
+            ciphers = b'DEFAULT:@SECLEVEL=0'
 
     s[b'minimumprotocol'] = minimumprotocol
     s[b'ciphers'] = ciphers
 
     # Look for fingerprints in [hostsecurity] section. Value is a list
     # of <alg>:<fingerprint> strings.
     fingerprints = ui.configlist(
         b'hostsecurity', b'%s:fingerprints' % bhostname
@@ -621,17 +621,17 @@ def wrapserversocket(
 
     # Improve forward secrecy.
     sslcontext.options |= getattr(ssl, 'OP_SINGLE_DH_USE', 0)
     sslcontext.options |= getattr(ssl, 'OP_SINGLE_ECDH_USE', 0)
 
     # In tests, allow insecure ciphers
     # Otherwise, use the list of more secure ciphers if found in the ssl module.
     if exactprotocol:
-        sslcontext.set_ciphers('DEFAULT')
+        sslcontext.set_ciphers('DEFAULT:@SECLEVEL=0')
     elif util.safehasattr(ssl, b'_RESTRICTED_SERVER_CIPHERS'):
         sslcontext.options |= getattr(ssl, 'OP_CIPHER_SERVER_PREFERENCE', 0)
         # pytype: disable=module-attr
         sslcontext.set_ciphers(ssl._RESTRICTED_SERVER_CIPHERS)
         # pytype: enable=module-attr
 
     if requireclientcert:
         sslcontext.verify_mode = ssl.CERT_REQUIRED
--- a/tests/test-https.t
+++ b/test;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2015 Steve Sprang &lt;scs@stevesprang.com&gt;
;;; Copyright © 2015-2024 Efraim Flashner &lt;efraim@flashner.co.il&gt;
;;; Copyright © 2015 Aljosha Papsch &lt;misc@rpapsch.de&gt;
;;; Copyright © 2016 Christine Lemmer-Webber &lt;cwebber@dustycloud.org&gt;
;;; Copyright © 2016 Jessica Tallon &lt;tsyesika@tsyesika.se&gt;
;;; Copyright © 2016 Andreas Enge &lt;andreas@enge.fr&gt;
;;; Copyright © 2016 Lukas Gradl &lt;lgradl@openmailbox.org&gt;
;;; Copyright © 2016, 2019, 2020 Alex Griffin &lt;a@ajgrf.com&gt;
;;; Copyright © 2017 Leo Famulari &lt;leo@famulari.name&gt;
;;; Copyright © 2017, 2018 Clément Lassieur &lt;clement@lassieur.org&gt;
;;; Copyright © 2017–2021 Tobias Geerinckx-Rice &lt;me@tobias.gr&gt;
;;; Copyright © 2017 Jelle Licht &lt;jlicht@fsfe.org&gt;
;;; Copyright © 2017, 2019 Eric Bavier &lt;bavier@member.fsf.org&gt;
;;; Copyright © 2017, 2020-2022, 2024 Nicolas Goaziou &lt;mail@nicolasgoaziou.fr&gt;
;;; Copyright © 2017 Manolis Fragkiskos Ragkousis &lt;manolis837@gmail.com&gt;
;;; Copyright © 2017 Rutger Helling &lt;rhelling@mykolab.com&gt;
;;; Copyright © 2018, 2022 Marius Bakke &lt;marius@gnu.org&gt;
;;; Copyright © 2018 Konrad Hinsen &lt;konrad.hinsen@fastmail.net&gt;
;;; Copyright © 2018 Thomas Sigurdsen &lt;tonton@riseup.net&gt;
;;; Copyright © 2018 Arun Isaac &lt;arunisaac@systemreboot.net&gt;
;;; Copyright © 2018 Pierre Neidhardt &lt;mail@ambrevar.xyz&gt;
;;; Copyright © 2018 Amirouche Boubekki &lt;amirouche@hypermove.net&gt;
;;; Copyright © 2018, 2019, 2020 Tim Gesthuizen &lt;tim.gesthuizen@yahoo.de&gt;
;;; Copyright © 2019 Jens Mølgaard &lt;jens@zete.tk&gt;
;;; Copyright © 2019,2022 Tanguy Le Carrour &lt;tanguy@bioneland.org&gt;
;;; Copyright © 2020, 2024 Guillaume Le Vaillant &lt;glv@posteo.net&gt;
;;; Copyright © 2020 Brice Waegeneire &lt;brice@waegenei.re&gt;
;;; Copyright © 2020 Jean-Baptiste Note &lt;jean-baptiste.note@m4x.org&gt;
;;; Copyright © 2020 Michael Rohleder &lt;mike@rohleder.de&gt;
;;; Copyright © 2020 Vinicius Monego &lt;monego@posteo.net&gt;
;;; Copyright © 2020 Hartmut