Groundwork work for keyholder-based MediaWiki deployments

Currently, when MediaWiki deployers push code, scap SSHs them into each host as
themselves, where they sudo to mwdeploy to run rsync. With keyholder, users
would be SSHing as mwdeploy directly. This requires setting a real shell for
mwdeploy and an SSH key.

Change-Id: I2523a13b99687f0c2ad2da2cd73a66abffe037b6