ssh: fix matching rules default
    
    Before the ssh_use_certificate_matching_rules option was added the ssh
    responder returned ssh keys derived from all valid certificates. Since
    the default of the ssh_use_certificate_matching_rules option is
    'all_rules' in a case where no matching rules are defined all
    certificated will be filtered out and no ssh keys are returned.
    
    The intention of the default was to allow the same same certificates
    which are allowed in the PAM responder for authentication. The missing
    default matching rule which is currently use by the PAM responder if no
    other rules are available is added by this patch.
    
    There might still be a small regression in case certificates without the
    extended key usage (EKU) clientAuth were used for ssh. In this case
    'ssh_use_certificate_matching_rules = no_rules' or a suitable matching
    rule must be added to the configuration.
    
    Related to https://pagure.io/SSSD/sssd/issue/4121
    
    Reviewed-by: Tomáš Halman <thalman@redhat.com>