localrepo: remove all internal uses of localrepo.opener
It has been replaced with localrepo.vfs. In the future we may split the vfs into
different vfs objects to access different elements of the repository.
sslutil: use saner TLS settings on Python 2.7.9
Asking for TLSv1 locks us out of TLSv1_2 etc. This is at least less
bad. Ideally we'd use ssl.create_default_context(), but that causes
more mayhem in the testsuite than I really want to deal with right
now.