s3:smb2_negprot: prefer AES128_CCM if the client supports it