login: T7839: add deprecation warning for DSS public-key usage

OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will
prevent users with such keys from logging in after upgrade. To avoid lockouts,
add a loud deprecation warning when users log in using a DSA key. This warning
advises affected users to replace their keys with a supported algorithm (e.g.,
ed25519 or RSA) before the upgrade.

Deprecation warning will be displayed during "commit" but also as MOTD to inform
on this issue during every login.

    DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
    be removed in VyOS 1.6. Please update affected keys to a supported
    algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
    failures after the upgrade. The following users are using SSH-DSS keys
    for authentication.

    User "vyos" with deprecated public-key named: foo

1 files changed, 18 insertions, 0 deletions

diff --git a/data/templates/login/motd_user_dsa_warning.j2 b/data/templates/login/motd_user_dsa_warning.j2
new file mode 100644
index 000000000..d3db18ff7
--- /dev/null
+++ b/data/templates/login/motd_user_dsa_warning.j2
@@ -0,0 +1,18 @@
+{% if user is vyos_defined %}
+{%     set ns = namespace (gen_header = True) %}
+{%     for user, user_config in user.items() %}
+{%         if user_config.authentication.public_keys is vyos_defined %}
+{%             for key, key_options in user_config.authentication.public_keys.items() %}
+{%                 if key_options.type is vyos_defined('ssh-dss') %}
+{%                     if ns.gen_header %}
+{%                         set ns.gen_header = False %}
+
+{{ ssh_dsa_deprecation_warning | wordwrap(72) }}
+
+{%                     endif %}
+User "{{ user }}" with deprecated public-key named: {{ key }}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
+{% endif %}