main/openssh: move ssh-keysign to separate subpackage

This is a helper utility for host-based authentication, which is
disabled by default and normally not needed.

We move it to subpackage because it is suid root.

fixes #3311