Add an OpenSSH package - #175

OpenSSH `sshd` writes free-form messages to Syslog, which makes remote
logins one of the most widely deployed and least structured
security-relevant log sources. Turn them into OCSF Authentication.

`openssh::ocsf::normalize` takes a message body all the way, and
`openssh::parse` and `openssh::ocsf::map` stay reachable for pipelines
that inspect, enrich, or route the structured event before mapping. All
three take their input positionally and write to `into`, following the
layered normalization API the package development tutorial describes.

A message body carries neither a timestamp nor a host, so the normalizer
takes `time` and `hostname` from the Syslog envelope. A message template
the parser does not model becomes an OCSF Base Event that carries its
payload, so no line is dropped.

The internal mapper took the whole staging record as `$scope`, so every
line carried a prefix that said nothing: `$scope.ocsf.user.name = move
$scope.event.user.name`. "Scope" also borrows a static-semantics word for
what is just a record with two fields.

Hand the leaf the two halves it actually uses, named for their shapes:

    openssh::ocsf::events::authentication $into.openssh, $into.ocsf

    $ocsf.user.name = move $openssh.user.name

Every line now names the vocabulary on each side, and the rule has no
special case: a product's shape is called after the product, a schema
after the schema, so `splunk::cim::ocsf::dns_activity` will take
`$into.ocsf, $into.cim`. The leaf also becomes callable on its own, which
a test can use.

Flattening the record literal into per-attribute assignments drops the
`...$ocsf` respread that only existed to preserve `status_detail`.

Baselines are unchanged.

Every operator that fills a field now takes the field it reads and the
field it writes, both positional:

    openssh::parse message, event
    openssh::ocsf::map event, ocsf

That retires `into=` and the staging record from both. `map` no longer
wraps the two halves in a composite to keep them disjoint, because the
caller already handed it two disjoint fields, so its body drops the
`$into.` prefix from every line and the mapper reads:

    $ocsf.time = move $openssh.time?

`openssh::ocsf::normalize` keeps `into=this`, because it produces a whole
event rather than filling a field. It is now the only operator that stages
anything, and it also owns the `unmapped` join that `map` used to perform,
which puts the residue decision next to the provenance decision.

Baselines are unchanged.

Classify every parsed verb through the lookup table and apply session-state overrides as record spreads. This removes the nested session-end branches without changing parsed values.

Eight cases the earlier input missed: IPv6 peers, the
`keyboard-interactive/pam` method, an attempt without a trailing protocol
token, an invalid user with a `[preauth]` phase, a maximum-attempts line
without the `error:` prefix, and an authenticating user on a connection
close.

Three more pin the limits rather than the coverage. `Postponed`, `Partial`,
and `Received disconnect` yield no event, which is what the package
promises for a template it does not model.