fix: set sshd_config permissions to 0600 for CIS compliance

[pdamianov-dev]

What this PR does / why we need it:
fix: set sshd_config permissions to 0600 for CIS compliance

Which issue(s) this PR fixes:
Fixes #8682

[Copilot]

Pull request overview

This PR fixes a CIS compliance regression in the Linux CSE provisioning flow by ensuring /etc/ssh/sshd_config is replaced with restrictive permissions when configureSSHPubkeyAuth() updates the file, and adds ShellSpec coverage to prevent future regressions.

Changes:

• Update configureSSHPubkeyAuth() to replace /etc/ssh/sshd_config with mode 0600 (instead of 0644) and root:root ownership.
• Add ShellSpec assertions that guard the install -m mode used when replacing $SSHD_CONFIG.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
parts/linux/cloud-init/artifacts/cse_config.sh	Changes the atomic replace of sshd_config to use install -m 600 for CIS 5.1.1 compliance.
spec/parts/linux/cloud-init/artifacts/cse_config_spec.sh	Adds regression tests to ensure configureSSHPubkeyAuth() does not revert sshd_config to non-compliant permissions.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: 171759078
Failed job/stage/task: e2e / Run AgentBaker E2E / Test_DCGM_Exporter_Compatibility/Ubuntu2404/default
Detective summary: This failure matches known SIG image-version listing throttling, not the sshd_config permissions change. E2E image discovery could not resolve the just-built SIG image because image-version pagination returned 429 Too Many Requests.

Likely cause/signature: Azure Compute Gallery / SIG image-version enumeration was throttled while looking up VHD images by �uildId=171759078.
Confidence: High
Recommended owner/action: AgentBaker E2E / Node Lifecycle infra owner should harden SIG image discovery with throttling-aware retry/backoff, narrower lookup, or caching; PR author can rerun the gate.
Strongest alternative: Earlier retryable VHD build warning, but less likely because the VHD build later succeeded and the hard failure was in E2E image discovery.

Evidence: build metadata, timeline, failed E2E log 538, test results, and repeated same-cycle failures on unrelated PRs.
Wiki signature: sig-image-version-list-resourcecollection-throttled
Repair item: #38763732