Checklist

• I've searched the issue tracker for similar bugs.

Describe the bug
MessageEncrypter specify the OutboundOpaqueMessage as the output of the AEAD encryption operation. To construct this type, these bytes are required while in fact the RFC 8446 §5.2 requires them to be hard-coded.

To Reproduce
Steps to reproduce the behavior:

1. Change the ring crypto backend encrypter to set the content type to Heartbeat
2. Make a round-trip with this crypto backend
3. The connection is established and application data stream works as usual

Applicable Version(s)
At HEAD of main.

Expected behavior
TLS 1.3 mode should reject anything but ApplicationData + TLS 1.2 version bytes. The setup above should result in decryption failure fatal alert when exchanging application data.