Disable sshd by default in bpo images

When generating your own image with pmbootstrap, and reading along in the wiki, it is clear that the resulting image will have the ssh daemon enabled by default. However, if installing a pre-built image, users will not expect that it has sshd enabled by default - especially since we need to set a default password.

So let's disable sshd in those images.

TODO:

• let wiki pages mentioning bpo images link to this issue
• get pmbootstrap install --no-sshd MR merged: pmbootstrap!2030
• add post-upgrade dummy for postmarketos-base with comment that we shall not symlink this to post-install... or else sshd will get enabled after each update. just to make sure we don't do this by accident in the future. pmaports!1964
• adjust bpo to use the option (here)

Note that the images with the on-device installer will ask the user whether they want to have sshd enabled or not in the target OS. The installer OS does have sshd enabled to for debugging, but that's not a concern since it doesn't connect to any network automatically on the devices where we provide pre-built images with the installer.