WIP: Support for optional legacy provider

[kulikjak]

Based on our discussion in #7358 I am opening this PR with the initial changes necessary for this feature.

It doesn't handle usage of legacy ciphers gracefully yet (with UnsupportedAlgorithm) and the question about whether it should be enabled explicitly or whenever it's available still needs to be decided, but it's a start.

I am open to any changes or suggestions - this is just what I came up with while having very limited knowledge of cryptography internals.