sslutil: allow TLS 1.0 when --insecure is used

--insecure is our psuedo-supported footgun for disabling connection
security.

The flag already disables CA verification. I think allowing the use of
TLS 1.0 when specified is appropriate.

mercurial/sslutil.py

@@ -181,6 +181,12 b' def _hostsettings(ui, hostname):'
     protocol = ui.config('hostsecurity', key, protocol)
     validateprotocol(protocol, key)
 
+    # If --insecure is used, we allow the use of TLS 1.0 despite config options.
+    # We always print a "connection security to %s is disabled..." message when
+    # --insecure is used. So no need to print anything more here.
+    if ui.insecureconnections:
+        protocol = 'tls1.0'
+
     s['protocol'], s['ctxoptions'] = protocolsettings(protocol)
 
     ciphers = ui.config('hostsecurity', 'ciphers')

tests/test-https.t

@@ -486,6 +486,12 b' Clients requiring newer TLS version than'
   abort: error: *unsupported protocol* (glob)
   [255]
 
+--insecure will allow TLS 1.0 connections and override configs
+
+  $ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/
+  warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
+  5fed3813f7f5
+
 The per-host config option overrides the default
 
   $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \