support gitlab's AuthorizedKeysCommand

https://gitlab.com/help/administration/operations/fast_ssh_key_lookup

Changes should be limited to adding the following to /etc/ssh/sshd_config:

AuthorizedKeysCommand /home/git/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k
AuthorizedKeysCommandUser git

On the most basic level, setting this with GITLAB_SSH_AUTHDB=true would enable the above change, nothing more. The user would be responsible for any migration. (It should be noted that this does nothing to the current authorized_keys file, so it is an additive configuration, not destructive.)

Some users may want an easy script for migrating keys out of the database back into a keys file, but I don't think it's critical: (1) this change is really only needed by large sites; (2) making the change only adds capability, it does not restrict future capability; and (3) undoing it should be a little difficult, as it is a little internal-sensitive (https://gitlab.com/help/administration/raketasks/maintenance.md#rebuild-authorized_keys-file) and requires clearing the redis cache, etc. So automating it should not be required.

Start by tracing how the image configures /etc/ssh/sshd_config and how the GITLAB_SSH_AUTHDB setting is handled. Add the two specified AuthorizedKeysCommand lines when enabled, then verify that existing authorized_keys behavior remains additive and that the resulting SSH configuration accepts the GitLab authorization command.