openssh: PermitRootLogin: no -> without-password

Disabling root login entirely instead of at least allowing SSH key
based access is impractical and doesn't really increase security much.

(And I've seen someone set it to 'yes' because they really wanted
root login but didn't know about without-password.)