openssh: flensing sshd_conf and service, fixing X11 forwarding

Given that for the most part OpenSSH defaults to sane choices, there's actually very little a user will need to specify or edit. The conf has been reduced to reflect this.

Of particular note, only RSA and ED25519 keys will be supported in interest of reducing attack surface. We favor ED25519 over ECDSA due to ECDSA's suspect NIST curves, we furthermore do not wish to bother with legacy DSA keys which are supposed to be an insufficient 1024-bits if compliant. Legacy RSA1 keys are also not welcome. We require AES ciphers and SHA2 MACs with a preference for AES-GCM ciphers and Encrypt-then-MAC SHA2 MACs. The Chacha20-Poly1305 cipher is also enabled and given priority along with ED25519 keys. 

I'd very much like to hear input on this, especially if there are aspects to the conf that may not work or are missing for a sane default. The proposed conf here has been running in production on about two dozen servers since around the release of 6.5 without issue. I've even compatibility tested it with some popular Windows applications (PuTTY, MobaXterm, Navicat, etc). Navicat will not like us excluding 'hmac-sha1' as of Navicat 11.x, there's free alternatives like HeidiSQL which uses PuTTY's Plink, which has no issues.

--with-xauth has been added, because otherwise, OpenSSH will default to looking in /usr/X11R6/bin for xauth if it does not find an xauth binary at build time. This breaks X11 forwarding.