Only negotiate PLAIN when using TLS with PasswordAuthenticator

When TLS is enabled, only PLAIN should be negotiated. There are multiple reasons why this is a good idea:

• We are on a secure connection already, SCRAM is not needed
• Less roundtrips/requests to send over SCRAM
• Always works with LDAP out of the box

(Description copied from Michael Nitschinger's commit summary)