STIG: Harden the SSH Daemon

The SSH daemon on this box ships wide open. Bring /etc/ssh/sshd_config into line with the DISA SSH STIG: disable direct root login, require key-based auth (no passwords), turn off X11 forwarding, cap authentication attempts (MaxAuthTries 4 or fewer), and set an idle-session timeout (ClientAliveInterval of 600 seconds or less). Grading inspects the actual sshd_config the way a SCAP scanner would — every control must pass to certify.