net.tls: handle SSL.Error from set_min/max_proto_version in is_supported_version

[gaurav0107]

Description

mitmproxy.net.tls.is_supported_version() builds an SSL.Context, sets the
min/max protocol version, then probes support with client_conn.recv(). Only
the recv() probe was wrapped in try/except SSL.Error.

On OpenSSL builds that have dropped a protocol version entirely (e.g. SSLv3
after POODLE / CVE-2014-3566, see pyca/cryptography#9523),
set_min_proto_version(SSL3_VERSION) raises SSL.Error immediately at
context-setup time — before the guarded recv(). The exception then
propagated unhandled and crashed callers. The only production caller,
TlsConfig._warn_unsupported_version, iterates over every Version to build
the "supported versions" list, so on those builds option validation crashed
outright.

This moves the protocol-version setters and connection setup inside the
existing try, so a setup-time SSL.Error is treated the same as a
probe-time one: the version is reported as unsupported (return False) instead
of raising. Behavior for currently-supported versions is unchanged.

A regression test (test_supported_setup_error) monkeypatches
SSL.Context.set_min_proto_version to raise SSL.Error, reproducing the crash
path deterministically on any OpenSSL build (the existing test_supported[SSL3]
only exercises the recv() path on builds that still allow SSL3 context setup).

Closes#8264

Note: #8254 also touches this function but bundles it with an unrelated CRLF
prettifier fix (#8253) across four files. This PR is a focused, single-concern
alternative scoped to #8264 only; happy to defer to whichever the maintainers
prefer.

Checklist

• I have updated tests where applicable.
• I have updated the CHANGELOG (## Unreleased: mitmproxy next).

[gaurav0107]

Heads up: the only red check is build (ubuntu-latest, linux-x86_64, debian), which failed at the Run apt-get update container-setup step (before checkout) — a transient apt-mirror hiccup unrelated to this change. Every code check is green: lint, mypy, individual_coverage, the full test matrix across Linux/macOS/Windows and Python 3.12–3.14, codecov/patch, and docs. A re-run of that one job should clear it. Happy to adjust anything on request.

[gaurav0107]

Update: I squashed the branch to a single commit (ad5f556) and re-pushed to re-trigger CI. The previously-red build (ubuntu-latest, linux-x86_64, debian) job — which had failed at the apt-get update container-setup step, before checkout — is now green, and the check gate passes as well. All checks are green and the code diff is unchanged (still the same net.tls fix + regression test); verified locally with the test/mitmproxy/net/test_tls.py suite, ruff, and mypy. Ready for review whenever you have a moment.