tls: keep maximum_version at MAXIMUM_SUPPORTED (was wrong workaround)

Reverted the TLS 1.2 max default I added while chasing what turned out
to be a make_post_sell bug, not an OTP bug. The actual root cause of
the production smoke-test failure was that mps_wallet_dist_health
hardcoded the REG_SEND target as 'Elixir.Wallet.Service' but portal
registers the relay as 'Elixir.Wallet.Bridge' — REG_SEND to an
unregistered name silently drops at the dist driver, presenting as the
'peer closed after 0/4 bytes' symptom that I misdiagnosed as a TLS
problem. Fix landed in make_post_sell 1.2.1.

erldistpy's defaults should stay where Python ssl wants them; callers
who want a specific version can still pin via kwargs.

erldistpy/tls.py

@@ -36,6 +36,7 @@ def make_dist_tls_context(
     ca: str,
     check_hostname: bool = False,
     minimum_version: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2,
+    maximum_version: ssl.TLSVersion = ssl.TLSVersion.MAXIMUM_SUPPORTED,
 ) -> ssl.SSLContext:
     """Build an SSLContext for a TLS-dist client.
 
@@ -43,11 +44,16 @@ def make_dist_tls_context(
     and requires one). ``check_hostname=False`` because dist nodes are
     identified by their cookie + cert chain, not by SNI hostname; flip
     on if your CA pins per-node CNs.
+
+    ``maximum_version`` defaults to the highest version Python's ssl
+    supports (TLS 1.3 in practice). Pin to TLS 1.2 explicitly only if
+    you hit interop issues against an older Erlang peer.
     """
     ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     ctx.check_hostname = check_hostname
     ctx.verify_mode = ssl.CERT_REQUIRED
     ctx.minimum_version = minimum_version
+    ctx.maximum_version = maximum_version
     ctx.load_cert_chain(certfile=cert, keyfile=key)
     ctx.load_verify_locations(cafile=ca)
     return ctx