Determine which tls options actually make sense to forward to tls.connect and throw if any other is provided (e.g. allowHalfOpen).