another SSH hook cleanup

this commits builds on top of all the other ones (except !5 (merged)). it does the following:

• move the password expiry from the ssh hook to random-root-password
• remove debootstrap_ssh_commands variable
• convert the ssh hook to a normal file, since it doesn't need to be a template
• make root password greppable as such

The second item requires more explanation. I found the variable to be superfluous: it can be better and more cleanly implemented by just adding an extra hook.

It's also possibly going to make the ssh hook a sinkhole where people shove everything in. It was already a bit the case: the password expiry, for example, had nothing to do with SSH. We similarly made the mistake of using the variable to add an extra hook into the install process, not realizing we could use the normal hook system.

So let's get rid of this before it creates any more confusion.