Allow any TLS version for STARTTLS check

From the tls package docs:
```
// MinVersion contains the minimum SSL/TLS version that is acceptable.
// If zero, then TLS 1.0 is taken as the minimum.
```
By my reading that means the STARTTLS check will fail if the server has STARTTLS enabled but is using SSLv2/3 (this is borne out by adding a test). Since we return if STARTTLS fails, the checker won't reach the version test and the result might be a bit confusing.

We may want to specify the lowest possible min version for the STARTTLS check to avoid a confusing failure - then we can catch the issue in the version check.

Start by reading the STARTTLS check and the existing regression test for servers using SSLv2/3, along with the Go TLS package documentation referenced in the issue. Confirm that the check rejects the connection before the version test, then make the STARTTLS check accept the lowest relevant TLS version and verify that the version check reports the result.

Written by the indexing model from the issue text.