harden ciphers and tls versions

PR:  https://forum.opnsense.org/index.php?topic=4860
See: https://github.com/phalcon/cphalcon/issues/12648

This looks a bit odd when we have the full struct and pass it down,
but is way easier to maintain than to tell the underlying code
this is a server or a client or whatever, because it shouldn't
matter as the vpnid is unique anyway.

Looking at openvpn_configure_server() and openvpn_configure_client()
it becomes a bit clearer why they take a config.xml subset: it's beause
the write_config() ordering was flipped.  We could probably now pass
an ID and let the code figure out if it is a client or server...

Switching the tty causes the terminal to exit, which means
the package upgrade jobs are not done, leaving files in the
system that shouldn't be there.

The $search parameter is unused.

... wrap with array() to proceed!

... that was written at a time when either Unbound or Dnsmasq
could run, but nowadays both can run in tandem which "breaks"
the service widget on the log page.  The log page now belongs
to the Unbound service.

Submitted by: Armin Tüting

This needs much maintenance, it's amazing really.

this whole procedure still seems a bit off when being called in return_gateway_groups_array(), maybe we should move this to a more sane location at some other point in time:

Now the old manual cron job only updates DynDNS, but the autocron
will fix itself...  :)