fix(security): enable KbdInteractiveAuthentication for SSH 2FA

configure_ssh_2fa only enabled the deprecated ChallengeResponseAuthentication
directive (removed as a usable knob in modern OpenSSH; it no longer controls
keyboard-interactive). The base tsys-sshd-config ships
KbdInteractiveAuthentication no, so on Debian 13 (OpenSSH 9.x/10.x)
keyboard-interactive stayed disabled. With AuthenticationMethods set to
"publickey,keyboard-interactive", sshd -t then failed:

  Disabled method "keyboard-interactive" in AuthenticationMethods list ...
  AuthenticationMethods cannot be satisfied by enabled authentication methods

which aborted provisioning under errexit.

Add the modern KbdInteractiveAuthentication yes directive alongside the
legacy one so 2FA works on both current and older OpenSSH.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

ProjectCode/Modules/Security/secharden-2fa.sh

@@ -93,6 +93,11 @@ function configure_ssh_2fa() {
         echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG"
     fi
 
+    if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then
+        sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \
+        echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG"
+    fi
+    
     # Enable PAM authentication
     if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then
         sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \