Lock this down, bit by bit.

This is an opinionated addition to the salt states in that SSH will be disabled by default. There's more we can do, but this gets us started.