Add optional {{ source }} to config files

OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,

We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.

Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.

Support complex compound matches in Match criteria. For example, be able
to match against multiple Users for a given Match, or be able to match
against address ranges. Or Groups. Or any combination thereof.

Support for matching users can take one of several different appearances
in pillar data:

sshd_config:
  matches:
    match_1:
      type:
        User: one_user
      options:
        ChrootDirectory: /ex/%u
    match_2:
      type:
        User:
          - jim
          - bob
          - sally
      options:
        ChrootDirectory: /ex/%u
    match_3:
      type:
        User:
          jim: ~
          bob: ~
          sally: ~
      options:
        ChrootDirectory: /ex/%u

Note the syntax of match_3. By using empty dicts for each user, we can
leverage Salt's pillar mergine. If we use simple lists, we cannot do
this; Salt can't merge simple lists, because it doesn't know what order
they ought to be in.

OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,

We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.

Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.

PrintLastLog missing in FreeBSD 11.0

The fix introduced in 678cc9066c
suppresses the PrintLastLog directive for FreeBSD 10.3.
SSH on FreeBSD 11.0 also does not support PrintLastLog, so this
change suppresses it for any version >= 10.3.

Test config before applying it

FreeBSD wheel group

Commit 038a51cdc8 introduced a change
where the sshd_config file is not managed unless the 'sshd_config'
pillar variable is defined. The kitchen tests did not define that
variable, so they stopped working.

This change sets a default value for 'Port' so the file is managed
by Salt.

This change has no impact on the kitchen tests, but only changes
a symbolic name from 'openssl' to 'openssh' to avoid confusion.

Opt-in to enforce RSA key length

openssh.auth_map

Add variables for file owner and mode

Add secure defaults to pillar.example + secure sshd_config in defaults.yml #66

Add test-kitchen configuration

in order to prevent unnecessary changes due to
random ordering of dig results.

Allow list or string for some option, and setting of ConfigBanner

setup sftp correctly on RedHat-like machines

`pillar.example` now contains information on how to use the
'string-or-list' feature for some options.

Also an explanation on the new `ConfigBanner` option.

Now ssh_config also accepts string-or-list options, for serveral
keywords.

Added a macro to handle multivalue options entered in either string
format or list format (with auto joiner).

Add ability to control SSH server service status (default: on)

do not set UsePAM on OpenBSD

Upstream opensshd does not support PAM

openssh.auth will produce invalid SLS definition if sshd_config configs are missing