First, the "data-ciphers" in openvpn defaults (depending on version and compile time configuration) to "AES-256-GCM:AES-128-GCM" or "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305". So taking "cipher" and just set it as "--data-ciphers $CIPHER" is wrong. When doing this compat work, we will now set "--data-ciphers" to "X:AES-256-GCM:AES-128-GCM". This should work, and if it's not suitable to the user, they still can set "data-ciphers" explicitly.
Also, when we do the compat works, it's wrong to still set "--cipher" to whatever it was. Instead, only set "--data-ciphers" for 2.5 and newer.
Fixes: 020ab0c4 ('service: automatically add the "cipher" to the "data-ciphers"')
This is an alternative to !64 (merged)