Fix SSH host certificate signing for the sshca role (#153)

Host signing returns 403 even though login succeeds: the policy grants the literal path sshca/sign/host, but the only role on the sshca mount is signhost, so the grant matches nothing. Hosts named directly under unkin.net also fall outside the role's allowed domains.

- Rename the policy to sshca/sign/signhost and grant that path
- Allow unkin.net alongside main.unkin.net and consul on the signhost role

Reviewed-on: #153
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/ssh_secret_backend_role/sshca/signhost.yaml

@@ -3,6 +3,6 @@ algorithm_signer: rsa-sha2-256
 ttl: 315360000  # 87600 * 3600
 allow_host_certificates: true
 allow_user_certificates: false
-allowed_domains: "main.unkin.net,consul"
+allowed_domains: "unkin.net,main.unkin.net,consul"
 allow_subdomains: true
 allow_bare_domains: false

policies/sshca/sign/signhost.yaml

@@ -1,7 +1,7 @@
 # Allow signing SSH host certificates
 ---
 rules:
-  - path: "sshca/sign/host"
+  - path: "sshca/sign/signhost"
     capabilities:
       - create
       - update