Prefer agent authentication to key_filename based authentication

Re-order the several authentication attempts in a way that potentially
password-less authentications are tried first (pkey, agent). Only then
try authentications that access private key files (which might need
decryption/unlocking). And finally exception-trigger password requests
for password-based authentication.

This eases authentication method detection workflows via analyzing the
exception that get thrown by paramiko.client.SSHClient()._auth(*args).