Add TLS transport option to pin the TLS version

[Zabrane]

Problem

Callers have no working way to pin the TLS version. A versions entry in transport_opts is silently dropped: gen_http_ssl:connect/3 only forwards socket_opts, verify, cacerts and the buffer sizes to ssl:connect.

Change

• New {tls, "1.2"} / {tls, "1.3"} transport option, mapped to {versions, ['tlsv1.2']} / {versions, ['tlsv1.3']} in both connect/3 and upgrade/5.
• Any other value raises {invalid_tls_version, Value} before connecting.
• Without the option, the OTP default applies, as before.
• When TLS 1.3 is pinned, the hardcoded {reuse_sessions, true} is dropped. It is a TLS =< 1.2 option, and OTP rejects it alongside a TLS-1.3-only version list:
  {options, incompatible, [reuse_sessions, {versions, ['tlsv1.3']}]}

gen_http:connect(https, "example.com", 443,
                 #{transport_opts => [{tls, "1.3"}]}).

Verification

Against a live server, reading ssl:connection_information(Socket, [protocol]):

Option	Result
{tls, "1.2"}	tlsv1.2 negotiated
{tls, "1.3"}	tlsv1.3 negotiated
{tls, "1.1"}	raises {invalid_tls_version, "1.1"}

[codeadict]

Awesome, really exciting to see a PR on this. Wondering if you are using the library for something. Thanks

[Zabrane]

Awesome, really exciting to see a PR on this. Wondering if you are using the library for something. Thanks

Oh yes. We use gen_http to connect to an ERP. Extremely stable.
Keep up the good work.