setup: require TLS 1.2 support from the Python interpreter (BC)
Before it was optional, and either 1.1 or 1.2 was sufficient. Now that the
default minimum is 1.2, it needs to be present to work out of the box.
The code here is more convoluted than the corresponding checks in `sslutil.py`,
but I'm leaving it alone because it can all be simplified when py38 is dropped.