Changes

fetchers/curl: modernise TLS 1.2 cipher suites
  * Drop support for DHE completely (logjam plus compat woes
   caused other browsers to do this some time ago)
 * Minimise CBC-mode suites
 * Fall back to non-PFS RSA suites if really necessary (we treat
   this as a protocol downgrade as anything modern should either
   be using TLS 1.3 or have support for the ECDHE suites)