audit-specs: Check ssh.socket instead of ssh running in qemu baselines

The qemu image build has been failing supascan since Oct 14 because
ssh.service isn't running when the baseline check runs.

Ubuntu 24.04 starts sshd through ssh.socket. The build boots the latest
noble cloud image, then runs apt-get dist-upgrade. When the archive has
a newer openssh-server than the image, the package upgrade stops
ssh.service and restarts only ssh.socket. Packer's existing session
keeps working, but nothing opens a new connection, so ssh.service stays
stopped until the check runs. Whether the check passes depends on
whether Ubuntu has shipped an openssh update since the last cloud
image. That's also why #2426 had to flip this same spec six weeks ago.

Drop the running check for ssh and check that ssh.socket is enabled
instead. That holds whether or not openssh gets upgraded during the
build.

Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: mmlb

audit-specs/baselines/qemu-build-amd64/service.yml

@@ -41,7 +41,8 @@ service:
     running: true
   ssh:
     enabled: false
-    running: true
+  ssh.socket:
+    enabled: true
   atd:
     enabled: false
     running: false

audit-specs/baselines/qemu-build-arm64/service.yml

@@ -41,7 +41,8 @@ service:
     running: true
   ssh:
     enabled: false
-    running: true
+  ssh.socket:
+    enabled: true
   atd:
     enabled: false
     running: false