Fully implemented with the NSS backend only for now.

Reviewed-by: Ray Satiro

... but make sure we use at least TLSv1.0 according to libcurl API

Reported-by: Cure53
Reviewed-by: Ray Satiro

... in case the handshake completes before entering
CURLM_STATE_PROTOCONNECT

Bug: https://bugzilla.redhat.com/1388162

5 more fixes, 2 more contributors

Serialise the call to PK11_FindSlotByName() to avoid spurious errors in
a multi-threaded environment. The underlying cause is a race condition
in nssSlot_IsTokenPresent().

Bug: https://bugzilla.mozilla.org/1297397

Closes #985

... when we are not asked to use a certificate from file

Some builds of GCC produce output on both stdout and stderr when --help
--verbose is used.  The 2>&1 redirection caused them to be arbitrarily
interleaved with each other because of stream buffering.  Consequently,
grep failed to match the fvisibility= string in the mixed output, even
though the string was present in GCC's standard output.

This led to silently disabling symbol hiding in some builds of curl.

... causing SIGSEGV while parsing URL with too many globs.
Minimal example:

$ curl $(for i in $(seq 101); do printf '{a}'; done)

Reported-by: Romain Coltel
Bug: https://bugzilla.redhat.com/1340757