On CPUs without AES support, ChaCha is always faster and safer than
software AES.

Add `crypto.core.aes.has_hardware_support` to represent whether
AES acceleration is available or not, and in `tls.Client`, favor
AES-based ciphers only if hardware support is available.

This matches what BoringSSL is doing.