openssh: enable --with-linux-memlock-onfault

This new configure option attempts to call the following as part of sshd
startup, simply warning if it fails:

`mlockall(MCL_CURRENT | MCL_FUTURE | MCL_ONFAULT)`

From https://man7.org/linux/man-pages/man2/mlock.2.html:

> Since Linux 2.6.9, no limits are placed on the amount of memory
> that a privileged process can lock and the RLIMIT_MEMLOCK soft
> resource limit instead defines a limit on how much memory an
> unprivileged process may lock.

Since sshd is run as root, locking all current and future pages
also will not run into hypothetical OOM issues.

pkgs/tools/networking/openssh/common.nix

@@ -36,6 +36,8 @@
   withSecurityKey ? !stdenv.hostPlatform.isStatic,
   withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl && withSecurityKey,
   withPAM ? stdenv.hostPlatform.isLinux,
+  # Attempts to mlock the entire sshd process on startup to prevent swapping.
+  withLinuxMemlock ? stdenv.hostPlatform.isLinux,
   dsaKeysSupport ? false,
   linkOpenssl ? true,
   isNixos ? stdenv.hostPlatform.isLinux,
@@ -119,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional (!linkOpenssl) "--without-openssl"
     ++ lib.optional withLdns "--with-ldns"
     ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth"
+    ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault"
     ++ extraConfigureFlags;
 
   ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} =