Disable password/root/GSSAPI/Kerberos SSH auth now that public keys are served by Kanidm.
Ship an sshd_config.d drop-in so sshd fetches authorized keys from Kanidm via kanidm_ssh_authorizedkeys. Named 10-* to take precedence over systemd-userdbd.