Stop restricting TLS listeners to the P-256 key exchange group (#20374)

Remove the `set_tmp_ecdh` call in
`ServerContextFactory.configure_context`. On OpenSSL 1.1.0+ it replaces
the default list of supported groups with only P-256, so TLS listeners
could not negotiate X25519 or X25519MLKEM768. The call was needed on
OpenSSL 1.0.x, which enabled no curves by default. Synapse now requires
[`cryptography>=3.4.7`](https://github.com/element-hq/synapse/blob/26a92c711161be9f9b8c69b33144ba7fe5b31063/pyproject.toml#L80),
so OpenSSL is always 1.1.0 or later. Twisted's `CertificateOptions`
already [skips this
step](https://github.com/twisted/twisted/blob/twisted-26.4.0/src/twisted/internet/_sslverify.py#L1848-L1854)
on 1.1.0+.

Fixes #20373

### Pull Request Checklist

<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->

* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
  - Use markdown where necessary, mostly for `code blocks`.
  - End with either a period (.) or an exclamation mark (!).
  - Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct (run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))

Signed-off-by: Bardi Harborow <bardi@bardiharborow.com>

changelog.d/20374.bugfix

@@ -0,0 +1 @@
+Fix TLS listeners only offering the P-256 group for key exchange, which prevented the use of the X25519 and post-quantum X25519MLKEM768 groups.

synapse/crypto/context_factory.py

@@ -25,8 +25,7 @@ from service_identity import VerificationError
 from service_identity.pyopenssl import verify_hostname, verify_ip_address
 from zope.interface import implementer
 
-from OpenSSL import SSL, crypto
-from twisted.internet._sslverify import _defaultCurveName
+from OpenSSL import SSL
 from twisted.internet.abstract import isIPAddress, isIPv6Address
 from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
 from twisted.internet.ssl import (
@@ -74,12 +73,6 @@ class ServerContextFactory(ContextFactory):
 
     @staticmethod
     def configure_context(context: SSL.Context, config: HomeServerConfig) -> None:
-        try:
-            _ecCurve = crypto.get_elliptic_curve(_defaultCurveName)
-            context.set_tmp_ecdh(_ecCurve)
-        except Exception:
-            logger.exception("Failed to enable elliptic curve for TLS")
-
         context.set_options(
             SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3 | SSL.OP_NO_TLSv1 | SSL.OP_NO_TLSv1_1
         )