Add @trusted_ssh_type for user to override

We need to expose the ability to override the type of match we want to
do. For example, we want to do match address 1.2.3.4 in sshd_config.

Change-Id: I28c5d71e62a62bd27f289a8bd70b235eac213e5c
Signed-off-by: Paul Belanger <pabelanger@redhat.com>

manifests/init.pp

@@ -1,6 +1,7 @@
 # == Class: ssh
 #
 class ssh (
+    $trusted_ssh_type = 'host',
     $trusted_ssh_source = 'puppetmaster.openstack.org',
     $permit_root_login = 'no',
 ) {

templates/sshd_config.erb

@@ -86,7 +86,7 @@ Subsystem sftp <%= scope.lookupvar('::ssh::params::sftp_path') %>
 UsePAM yes
 
 # allow ansible connections from puppetmaster host
-Match host <%= @trusted_ssh_source %>
+Match <%= @trusted_ssh_type %> <%= @trusted_ssh_source %>
     PermitRootLogin without-password
 # allow ansible connections from localhost
 Match host localhost