Motivation for this change

This patch makes it way harder to screw Match groups in an sshd config
up. With a broken SSH, reverting with tools like nixops is way harder,
in some cases impossible.

The diff seems larger than it actually is, mainly because I moved all
options that can be used "globally" and in a Match group into its own
attribute set that will be merged into options.services.openssh and
for the matches submodule.

The Match config will be appended to /etc/ssh/sshd_config using
mkOrder 9999 to ensure that no extraConfig will be appended
afterwards and only applies to the last Match group.

It can be used like this now:

{
  services.openssh = {
    enable = true;
    permitRootLogin = "no";
    matches = [
      {
        # the given config only applies to the 10.23.42.0/24 subnet
        match."10.23.42.0/24" = "Address";
        config.permitRootLogin = "yes";
      }
    ];
  };
}

Finally extended the openssh testcase with another machine to demonstrate
the functionality by permitting root logins only from certain IPs.

Some additional notes:

• I didn't add a changelog entry yet, as I'm not sure if this will land in 19.03
• I've tested this in a local VM network and added another NixOS test. I'll deploy this to one of my machines in my personal setup later this afternoon just to confirm (EDIT: done)

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.