Disallow ssh+password login for khoe, deny ssh to users (in khoe-users)

[MarcDiethelm]

Note: this breaks default rsync+ssh use.
But rsync+ssh is suboptimal anyway, we don't want the user to be able to read/write anywhere in their home directory. rsync+sftp is probably the way to go for future file syncing to Khoe.

Possibly enable with -e ssh=yes [default: no]