feat: harden the host's SSH server through napalm-device-types

LinuxDriver mixes in OpenSshServerMixin, so netOrk can take algorithms
ssh-audit flagged out of what sshd offers. The work is the base's; the
driver brings run_command, which already runs as root over an exec channel.

Requires napalm-device-types 4.5.0; bumps to 0.5.0. NetOrk/netork#1027

tests/test_linux.py

@@ -1673,3 +1673,23 @@ class TestGetVirtualIps:
         privileged, plain = (c.command for c in channels)
         assert privileged.startswith("sudo -n sh -c 'sh -c '")
         assert plain.startswith("sh -c '")
+
+
+class TestHardensItsSshServer:
+    """A stock Linux host runs a stock OpenSSH: the hardening netOrk offers for
+    ssh-audit findings comes from napalm-device-types, carried over run_command
+    (NetOrk/netork#1027)."""
+
+    def test_mixes_in_the_openssh_hardening(self):
+        from napalm_device_types import OpenSshServerMixin
+
+        assert issubclass(LinuxDriver, OpenSshServerMixin)
+        assert callable(getattr(LinuxDriver, "harden_ssh_server", None))
+
+    def test_reads_the_algorithms_as_root_over_the_command_channel(self, driver):
+        from napalm_device_types import CommandResult
+
+        out = "kexalgorithms a\nhostkeyalgorithms b\nciphers c\nmacs d\n"
+        with patch.object(driver, "run_command", return_value=CommandResult(out, "", 0)) as run:
+            assert driver.get_ssh_server_algorithms()["mac"] == ["d"]
+        assert run.call_args.kwargs["privileged"] is True