Claims to disable SSH certificate types

[maraino]

Description

With the support of SSH user certificates in the GCP provisioner, PR #1558, we might want to add two new claims to turn off SSH user or host certificates.

The claims will be false by default, meaning user and host certificates are allowed.

The claims will depend on the EnableSSHCA claim to be set to true.

[hslatman]

The change in behavior, if made, should be clear in release notes.

Keep the existing behavior for user certs: default to true (disable user certs)?