Make pre-login sshd banner optional

This change makes the creation of /etc/ssh/sshd_banner contingent
on having included the ssh::bastion class (iff the ssh class is
also there, of course)

The file is not removed if it exists, allowing for custom banners
if needed by other classes or local config.

Nice side effect: the ssh::bastion class is also now a nice
repository for other configuration we would like to apply only
to bastion-like instances.

Change-Id: Icf2da19edbdb1bc5c46a7275c5d14bb278a24e0d
Merge "Make pre-login sshd banner optional" into production