STIG: Enforce Strong SSH Crypto

This host's SSH daemon still negotiates legacy, broken cryptography: CBC-mode ciphers, MD5/SHA-1 MACs, and SHA-1 key exchange. Bring /etc/ssh/sshd_config to the Ubuntu 22.04 STIG's FIPS 140-3 lists. Each of Ciphers, MACs and KexAlgorithms must be set explicitly and list only algorithms the STIG approves. Note that modern favourites like chacha20-poly1305 and curve25519 are strong but not FIPS-approved, so the STIG rejects them. Grading reads the effective algorithm lists (sshd -T) the way the STIG check does.