Use a service unit to strip ssh_keys group from host keys (rhbz#2172956)
    
    Use a systemd service unit to strip the ssh_keys group and change the
    mode for host keys. This ensure that this migration is done right before
    the openssh server startup on all kind of systems, either RPM or
    rpm-ostree based.
    
    Use a marker file to only do this once. We need to keep this service
    unit for two Fedora releases so we will be able to remove it in Fedora
    40.
    
    See: https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
    Fixes: 7a21555 Get rid of ssh_keys group for new installations
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2172956
    
    Co-authored-by: Timothée Ravier <tim@siosm.fr>