feat(ssh): add ping/nmap/ca-certificates to base image

A lived-in Linux box ships with iputils-ping, ca-certificates, and nmap
available. Their absence is a cheap tell, and they're handy for letting
the attacker move laterally in ways we want to observe. iproute2 (ip a)
was already installed for attribution — noted here for completeness.

templates/ssh/Dockerfile

@@ -16,6 +16,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     inotify-tools \
     psmisc \
     iproute2 \
+    iputils-ping \
+    ca-certificates \
+    nmap \
     jq \
     && rm -rf /var/lib/apt/lists/*