Sasl PLAIN mechanism should only be enabled/offered after TLS layer is establish

From RFC 4513 section 3.1.5:

"The server may advertise different capabilities after installing a
TLS layer. In particular, the value of 'supportedSASLMechanisms' may
be different after a TLS layer has been installed (specifically, the
EXTERNAL and PLAIN [PLAIN] mechanisms are likely to be listed only
after a TLS layer has been installed)."

So we should only expose the PLAIN or EXTERNAL mechanism as a value in the RootDSE's supportedSASLMechanisms attribute for those clients possessing sessions with TLS confidentiality.