Make sshd PermitRootLogin configurable

Make this configurable so that it can be enabled for images used
by nodepool.

Change-Id: I704453c6d3091a24e68509650c61efb638aea601

manifests/init.pp

@@ -1,6 +1,9 @@
 # == Class: ssh
 #
-class ssh ($trusted_ssh_source = 'puppetmaster.openstack.org') {
+class ssh (
+    $trusted_ssh_source = 'puppetmaster.openstack.org',
+    $permit_root_login = 'no',
+) {
     include ::ssh::params
     package { $::ssh::params::package_name:
       ensure => present,

templates/sshd_config.erb

@@ -23,7 +23,7 @@ LogLevel INFO
 
 # Authentication:
 LoginGraceTime 120
-PermitRootLogin no
+PermitRootLogin <%= @permit_root_login %>
 StrictModes yes
 
 RSAAuthentication yes