Make use of the recently added nullable `mkPackageOption` feature
to disable installing an SSH client by default: most people should use
the client provided by their system.
This switches the type of `matchBlocks` from `loaOf` to `listOrDagOf`.
The former has been deprecated in Nixpkgs. The latter allows
dependencies between entries to be expressed using the DAG functions.