feat: add TLS versions configuration

[tuminoid]

Overview

Add configuration options for TLSMinVersion and TLSMaxVersion.

This enables configuring specific TLS versions to accept. That allows use-cases such as setting TLS 1.3 as minimum version (disables TLS 1.2), or enforcing TLS 1.2 only (disables TLS 1.3) for easier debugging of secure connections.

Default functionality of Go TLS is to allow TLS 1.2 and TLS 1.3 and have client and server negotiate. (Except in Dex 2.37.0 where TLS 1.0 to TLS 1.3 were always enabled).

serve.go doesn't have any unit tests, so didn't add any. Unit tests are added for config.go.

Special notes for your reviewer

This can be tested with sslyze for example:

1. Generate certs cd examples/k8s; ./gencert.sh
2. cp config.dev.yaml config.yaml
3. Add following under web:

  https: 127.0.0.1:5554
  tlsCert: examples/k8s/ssl/cert.pem
  tlsKey: examples/k8s/ssl/key.pem
  tlsMinVersion: 1.3
  tlsMaxVersion: 1.3

4. Run dex

gh pr checkout <PR number>
rm -f bin/dex; make; bin/dex serve config.yaml

5. pip3 install sslyze (use virtualenv etc as needed)
6. sslyze 127.0.0.1:5554 or use openssl if you like
7. Check the report and see TLS 1.3 is the only one enabled, TLS 1.2 is refused

[tuminoid]

@nabokihms @sagikazarmark PTAL. It would be awesome to get this into 2.38.0.