feat: OpenSshServerMixin takes flagged algorithms out of what sshd offers

ssh-audit names algorithms an SSH server should stop offering. Taking them
out is the same on every OpenSSH host, so it lives here once: a driver
mixes in OpenSshServerMixin and supplies run_command.

harden_ssh_server reads the lists sshd really uses (sshd -T), removes the
requested algorithms and writes the rest to
/etc/ssh/sshd_config.d/00-netork-ssh-hardening.conf -- or, where
sshd_config has no Include of that directory, rewrites sshd_config after
a copy. It never removes the last algorithm of a list, nor, given the
managing client's lists, the last one that client speaks. sshd -t must
accept the result and sshd -T must show it; after the reload the caller's
verify opens a new session, and if that fails the still-open one puts the
previous state back and reloads again.

Bumps to 4.5.0. NetOrk/netork#1027

README.md

@@ -110,6 +110,18 @@ A mechanism it could not read completely is `None` ("did not look"), a host with
 `[]`. The command is about 4 kB, so a driver sends it on an exec channel
 (`_run_virtual_ips_command(command, privileged=)`), not typed into a shell.
 
+`OpenSshServerMixin` (`harden_ssh_server`, `get_ssh_server_algorithms`) takes algorithms
+out of what an OpenSSH server offers -- the ones ssh-audit flags. It reads the lists sshd
+really uses (`sshd -T`), takes out what was asked and writes the rest to
+`/etc/ssh/sshd_config.d/00-netork-ssh-hardening.conf`; only where sshd_config has no such
+`Include` is sshd_config itself rewritten, after a copy. It never removes the last algorithm
+of a class, nor -- given the managing client's lists -- the last one that client speaks.
+`sshd -t` must accept the result and `sshd -T` must show it; after the reload the caller's
+`verify` opens a new session, and if that fails the still-open one puts the old state back.
+A driver mixes it in and supplies `run_command`; a platform that regenerates sshd_config
+itself (an appliance with its own database) must not, or opts out with
+`harden_ssh_server = None`.
+
 **Update readers raise when they cannot read.** `get_available_updates` returns an empty
 list only when nothing is pending; netOrk keeps "pending since" per package, and an empty
 list for "don't know" would reset it.