Harden TLS protocol selection

[jpantonow]

Summary

This revision keeps Conscrypt's generic TLS context so TLS 1.3 and future provider-supported protocol versions remain available. The security policy is applied where protocols are actually configured: TLSEnabledSSLSocketFactory no longer replaces the provider defaults with a closed list that explicitly enabled TLS 1.0 and TLS 1.1.

Changes

• keep SSLContext.getInstance("TLS", "Conscrypt") instead of pinning TLS 1.2;
• preserve the provider-enabled protocol set;
• remove only known deprecated SSL/TLS protocol names;
• apply the same policy to HTTP and MQTT users of the shared socket factory;
• restore the original configureTLS structure and project indentation.

Compatibility

TLS 1.2 remains supported. TLS 1.3 and future protocols enabled by Conscrypt are not excluded. Endpoints that support only SSLv3, TLS 1.0, or TLS 1.1 will no longer connect through this custom socket factory.

Validation

• git diff --check
• Change limited to TLS context/socket protocol configuration
• Gradle ktlintCheck (local Android Build Tools 36.0.0 installation is missing AAPT, so Gradle cannot configure all modules)

This supersedes the initial TLS 1.2 pin, which satisfied the analyzer's literal allowlist but could prevent TLS 1.3 negotiation.

[Waboodoo]

Looks good to me, thanks for the contribution