There's advice available on preferred choices of key exchange, message
authentication and ciphers from a number of sources [1][2][3], all of
which don't _entirely_ agree with each other, and then there's the
hardcoded selection of Kex, MAC and ciphers encoded in this cookbook.

After initial discussions around this change with @chris-rock and
@artem-sideorenko, there may be follow-on changes to the hardcoded
selections this cookbook generates, however that's a topic for future
discussion and PRs.

There is likely to be more complexity and balancing of features/security
to consider plus the future changes of refactors in this cookbook, so
initially, I'd just like a way of overriding the generated defaults.

Note that `node['ssh'][{'client', 'server'}][{'weak_hmac', 'weak_kex',
'cbc_required'}}` are all ignored if these overrides are used, as the
user is supplying their preferred choices, rather than relying on the
cookbook's generated strings.

[1] https://github.com/arthepsy/ssh-audit
[2] https://wiki.mozilla.org/Security/Guidelines/OpenSSH
[3] https://stribika.github.io/2015/01/04/secure-secure-shell.html