default install security configurations

[K2]

I re-read the website and it specifies this repository for issues. Please see clearlinux/tallow#6 as it was default install in-box with clear at the time of filing. @matthewrsj ping.

As an option, consider default install with no services at all.

[matthewrsj]

Default install adds the openssh-server bundle which installs tallow. Since this security issue will exist whether or not it is a default bundle, I think the best approach is to fix tallow rather than remove the bundle from the default install list. @ahkok ping.

[matthewrsj]

For now it has been removed from the openssh-server bundle so will not be on user systems (or default installs) when the next OS version is released. It will be added back when the issue is fixed.

[ahkok]

Issue closed upstream, update posted to clearlinux as well.

[ahkok]

FTR we put it back in the bundle as well, so there should not be a gap in between releases.