tests: make every sshd test selectable

run_all_sshd_tests.sh validates --match and --exclude against test_cases
plus a new extra_test_cases naming the tests called in place, and every
call goes through one should_skip(). A match runs its test where it
sits, with the daemon it needs around it, so one path now serves the
whole suite. test_cases named 12 of the 32 tests the runner drives.

- gate the x509, UPN and ML-DSA daemon starts on the match, so selecting
  another test does not start them
- take the bulk skip for the tests needing a local daemon only on a full
  run, where its fixed count is right
- reject an unrecognized --exclude, and a --match that reached no call
  site: a local-only name selects nothing against an external host,
  which would otherwise exit 0 having run no test at all
- keep every test call inside one compound, so RUN_COMPLETE still fails
  a run that a shell expansion error cut short, and abort naming any
  run_test call listed in neither array
- verified in the container: a full run gives 32 run, 30 passed, 2
  skipped, and --match sshd_chroot_fail_test.sh gives 1 run, 1 passed,
  starting only the daemon that test needs

Author: ejohnstown

apps/wolfsshd/test/README.md

@@ -80,3 +80,20 @@ after the test files have been setup:
  52 set +e
 ```
 
+The name also has to be listed in one of the two arrays at the top of
+run_all_sshd_tests.sh, or the run aborts with an error naming it. Use
+`test_cases` if the test runs against the shared daemon, in which case the loop
+over that array calls it and nothing else is needed. Use `extra_test_cases` if
+the test needs setup of its own -- a different daemon config, its own daemon, or
+the shared daemon stopped first -- and keep the `run_test` call where that setup
+happens. Both arrays drive `--match` and `--exclude`, so a test that is missing
+from them cannot be selected or skipped from the command line.
+
+## Selecting Tests
+
+`--match <name>` runs a single test and `--exclude <name>` drops one from a full
+run. Both take any name from the list the runner prints when it is given a name or an
+option it does not recognize, and an unrecognized name is an error rather than a
+silent no-op. `--match` runs the test where it sits in the suite, with the
+daemon it needs set up around it.
+