feat(ssh): add bootstrap-ssh-ca role for OpenBao SSH user CA trust

Deploy TrustedUserCAKeys, auth_principals from ssh_principals.yaml, and
Makefile targets bootstrap-ssh-ca / bootstrap-ssh-ca-host (NET-WP-0020 T5).

ansible/roles/ssh_ca_host/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted