[release-branch.go1.8] doc: mention SHA-256 CBC suites are off by default

Change-Id: I82c41bd1d82adda457ddb5dd08caf0647905da22
Reviewed-on: https://go-review.googlesource.com/36091Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
(cherry picked from commit de479267)
Reviewed-on: https://go-review.googlesource.com/36130

doc/go1.8.html

@@ -799,9 +799,9 @@ Optimizations and minor bug fixes are not listed.
       hardware support for AES-GCM is present.
     </p>
 
-    <p> <!-- CL 27315 -->
+    <p> <!-- CL 27315, CL 35290 -->
       AES-128-CBC cipher suites with SHA-256 are also
-      now supported.
+      now supported, but disabled by default.
     </p>
 
   </dd>