"Hardened Debian Server 12" policy requires updates

[perkelix]

new kex alias

Since 1:9.2p1-2+deb12u4 the OpenSSH port on Debian incldues the following:

Make sntrup761x25519-sha512 key exchange algorithm available without the @openssh.com suffix too.

This is to match what became available as an official kex since OpenSSH 9.9.

It would be a good idea to update the policy to avoid failing if the above backported feature is found.

Demote non-quantum to Optional

Likewise, this updated policy should consider curve25519-sha256* and diffie-hellman-* as Optional to match the recommendations of a scan performed without specifying the policy.