yet another mod_ssl temp DH handling tweak

[Joe Orton]

One more tweak here, proposed by Hubert from our QA team who has been 
reviewing all this stuff.  Hubert argued we should be erring on the side 
of stronger not weaker here, particularly because of the possibility of 
2048-bit keys being identified as 2047 in rare cases.

Is this reasonable?

Index: ssl_engine_init.c
===================================================================
--- ssl_engine_init.c   (revision 1603915)
+++ ssl_engine_init.c   (working copy)
@@ -101,11 +101,11 @@
  * to our copy. */
 DH *modssl_get_dh_params(unsigned keylen)
 {
-    if (keylen >= 4096)
+    if (keylen > 3072)
         return dhparam4096;
-    else if (keylen >= 3072)
+    else if (keylen > 2048)
         return dhparam3072;
-    else if (keylen >= 2048)
+    else if (keylen > 1024)
         return dhparam2048;
     else
         return dhparam1024;