penalty test is still a bit racy

crank up penalty timeouts so this should work on even the slowest of
test builders

split the PerSourcePenalties test in two: one tests penalty enforcement
but not penalty expiry, the other tests penalty expiry.

This lets us disable the expiry testing in certain CI test environments.

don't redirect stderr for ssh-keyscan we expect to succeed

specify an algorithm for ssh-keyscan, otherwise it will make
multiple attempts simultaneously and confuse the test

regress test for PerSourcePenalties

crank up penalty timeouts so this should work on even the slowest of
test builders

split the PerSourcePenalties test in two: one tests penalty enforcement
but not penalty expiry, the other tests penalty expiry.

This lets us disable the expiry testing in certain CI test environments.

don't redirect stderr for ssh-keyscan we expect to succeed

specify an algorithm for ssh-keyscan, otherwise it will make
multiple attempts simultaneously and confuse the test

regress test for PerSourcePenalties

regress test for PerSourcePenalties