Enfoce SSH Certificates via Settings

A new boolean group setting is introduced in order to control
whether SSH certificates are enforced or not.

The previous approach can be safely removed later because
it hasn't been released yet.

A customer has noticed that with the current approach deploy
key won't be accepted as well. It shows the limitation of
treating SSH certificates as a separate Git protocol.

Changelog: added