move IP-based SSH connection limits to nftables

We use synproxy for establishing all new connections to the SSH port and
enforce a connection limit between synproxy and the standard network
stack. Once the connection limit is reached, it's also enforced for new
connections at the synproxy layer. This avoids creating conntrack and
connection limit set entries until connections are already established
to avoid packets with spoofed source addresses exhausting these limited
size tables. Primary servers using SSH to mirror TLS certificates to
their replicas are allowlisted.

ssh/sshd_config

@@ -105,7 +105,6 @@ ClientAliveInterval 60
 ClientAliveCountMax 10
 #UseDNS no
 #PidFile /run/sshd.pid
-PerSourceMaxStartups 1
 MaxStartups 4096
 #PermitTunnel no
 #ChrootDirectory none