Add variable for sysctl options, add ssh-keysign mitigations and block new kernel modules

[wtripp180901]

• Added sysctl_options variable so allow setting sysctl options persistently through drop-in files. Includes a default option to turn of access to ptrace in order to mitigate ssh-keysign-pwn CVE
• Refactored module denylist to have its defaults separate from the variable exposed to the user to prevent accidental overriding
• Now blocks any new modules not in allowlisted_modules from being loaded. By default allows all modules which Rocky loads by default. Doesn't follow same defaulting pattern as above to make removing problematic modules from allowlist easier

Tested against recent privilege escalation CVEs:

• Copy-fail
• Copy-fail 2
• Fragensia
• Dirty-frag
• ssh-keysign-pwn