Can't connect to a TLS-enabled Vault on JRuby

We're using JRuby-9.1.16.0 against a TLS-enabled Vault. The very most minimal Vault-client script:

```ruby
require 'vault'

Vault::Client.new.help('/')
```

Fails when you run it:

```shell-session
$ rvm use jruby-9.1.16.0@vault --create
$ gem install vault
$ VAULT_ADDR=https://localhost:8200 ruby tmp.rb
OpenSSL::SSL::SSLError: no cipher match
ciphers= at org/jruby/ext/openssl/SSLContext.java:508
set_params at org/jruby/ext/openssl/SSLContext.java:562
connect at /Users/dmaze/.rvm/rubies/jruby-9.1.16.0/lib/ruby/stdlib/net/http.rb:903
do_start at /Users/dmaze/.rvm/rubies/jruby-9.1.16.0/lib/ruby/stdlib/net/http.rb:868
start at /Users/dmaze/.rvm/rubies/jruby-9.1.16.0/lib/ruby/stdlib/net/http.rb:863
start at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/persistent.rb:698
connection_for at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/persistent.rb:625
request at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/persistent.rb:933
request at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/client.rb:273
get at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/client.rb:182
help at /Users/dmaze/.rvm/gems/jruby-9.1.16.0@vault/gems/vault-0.11.0/lib/vault/api/help.rb:29
at tmp.rb:3
```

(Very low-level debugging with Wireshark indicates that this never gets past the initial TCP connection: _something_ must be listening on the indicated port but it doesn't necessarily need to be Vault or anything knowledgable about TLS; you get the same behavior if you launch a parallel `nc -l 8200` and point the script at that.)

It looks like [Vault's default SSL client cipher suite](https://github.com/hashicorp/vault-ruby/blob/master/lib/vault/defaults.rb#L17) is `"TLSv1.2:!aNULL:!eNULL"` but JRuby's OpenSSL implementation doesn't understand this:

```shell-session
$ irb
jruby-9.1.16.0 :001 > require 'openssl'
=> true
jruby-9.1.16.0 :002 > ctx = OpenSSL::SSL::SSLContext.new
=> #
jruby-9.1.16.0 :003 > ctx.set_params ciphers: "TLSv1.2:!aNULL:!eNULL"
OpenSSL::SSL::SSLError: no cipher match
from org/jruby/ext/openssl/SSLContext.java:508:in `ciphers='
from org/jruby/ext/openssl/SSLContext.java:562:in `set_params'
```

If you go in and look at the list of ciphers available by default:

```shell-session
$ irb
jruby-9.1.16.0 :001 > require 'openssl'
=> true
jruby-9.1.16.0 :002 > ctx = OpenSSL::SSL::SSLContext.new
=> #
jruby-9.1.16.0 :003 > ctx.ciphers
=> (elided)
jruby-9.1.16.0 :004 > ctx.ciphers[0]
=> ["DES-CBC-SHA", "TLSv1/SSLv3", 56, 56]
```

You will notice that they all advertise `TLSv1/SSLv3`, but none of them advertise `TLSv1.2`. JRuby has a long [hard-coded list of available ciphers](https://github.com/jruby/jruby-openssl/blob/master/src/main/java/org/jruby/ext/openssl/CipherStrings.java) and in particular there is an `SSL_TLSv1` bit, but not a bit for "TLS v1.2". There are some worrisome very old JRuby issues, like jruby/jruby#1738, that suggest that a fix in the underlying platform may not be coming soon.

It looks like I can work around this by setting an environment variable `VAULT_SSL_CIPHERS`. If I have to set it to something else, is there a good value to set it to? I can construct a working value based on https://wiki.mozilla.org/Security/Server_Side_TLS#Mandatory_discards

```sh
VAULT_ADDR=https://localhost:8200 \
VAULT_SSL_CIPHERS=ALL:!aNULL:!eNULL:!EXPORT:!RC4:!DES:!SSLv2:!MD5 \
ruby ./tmp.rb
```

but I can't tell whether I'm telling the system to use something that's known to be unsafe.

It'd also be helpful if the Vault client library could detect it was running on JRuby and use a different default, if that's appropriate.