Limit host based key types used by ansible

By default, ansible prefers to try host based authentication, which is good.

But when it doesn't work, it tries every key attempt, which is normally fine.

However, SSH counts key attempts the same as passwords, so hardening that restirct password attempts are fouled before it can even get to try a public key.  Thus let host based only consume one attempt.

confluent_server/confluent/runansible.py

@@ -130,6 +130,11 @@ class PlayRunner(object):
                 feedback.setblocking(False)
                 localenv = os.environ.copy()
                 localenv['FEEDBACK_SOCK'] = sockpath
+                # limit host based algorithms to avoid excessive authentication attempts
+                ansiblesshargs = os.environ.get('ANSIBLE_SSH_ARGS', '')
+                if 'hostbasedkeytypes' not in ansiblesshargs.lower() and 'hostbasedacceptedalgorithms' not in ansiblesshargs.lower():
+                    ansiblesshargs += ' -o HostbasedAcceptedAlgorithms=*ed25519*'
+                localenv['ANSIBLE_SSH_ARGS'] = ansiblesshargs
                 with feedback:
                     for playfilename in self.playfiles:
                         worker = await asyncio.create_subprocess_exec(