Closes #21013 by modfying ssl.create_default_context() to:

* Move the restricted ciphers to only apply when using
  ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
  is the lack of RC4 in the restricted. However there are servers that exist
  that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
  will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
  of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
  socket the context will prioritize our ciphers which have been carefully
  selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
  that end users can more easily determine if they need to unset
  ssl.OP_NO_SSLv3.

Previously a non-string, non-regex second argument could cause the test
to always pass.

Initial patch by Kamilla Holanda.

Issue #20913: improve the SSL security considerations to first advocate using create_default_context().

Issue #20913: improve the SSL security considerations to first advocate using create_default_context().

Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".

(should also fix a buildbot failure introduced by #20995)

Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".

(should also fix a buildbot failure introduced by #20995)

to prevent buildbot failures on test_idle.  This change
should go back in once #20035 is fixed.

A patch from Berker Peksag.

solution.

Currently, Tix is not built in Debug configuration.

This change also:
- simplifies some Tcl/Tk-related msbuild properties for _tkinter
- copies the Tcl and Tk DLLs into the build output directory, meaning
  they will always be available after a build without having to copy
  them manually or change PATH
- removes PCbuild/build_tkinter.py: the solution does the build without
  needing to invoke Python (so Tcl/Tk/Tix can be built in parallel with
  the rest of the build using the `/m` msbuild command line switch)
- removes an outdated README concerning building Tcl/Tk on AMD64

Closes #20995 by Enabling better security by prioritizing ciphers
such that:

* Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
* Prefer ECDHE over DHE for better performance
* Prefer any AES-GCM over any AES-CBC for better performance and security
* Then Use HIGH cipher suites as a fallback
* Then Use 3DES as fallback which is secure but slow
* Finally use RC4 as a fallback which is problematic but needed for
  compatibility some times.
* Disable NULL authentication, NULL encryption, and MD5 MACs for security
  reasons

Popa.

Patch by Claudiu Popa.