evolinux-base : remove root from AllowUsers directive

when disabling root login, also remove it from AllowUsers if present

evolinux-base/tasks/root.yml

@@ -88,4 +88,13 @@
   notify: reload sshd
   when: evolinux_root_disable_ssh
 
+- name: remove root from AllowUsers directive
+  replace:
+    dest: /etc/ssh/sshd_config
+    regexp: '^(AllowUsers ((?!root(?:@\S+)?).)*)(\sroot(?:@\S+)?|root(?:@\S+)?\s)(.*)$'
+    replace: '\1\4'
+    validate: '/usr/sbin/sshd -T -f %s'
+  notify: reload sshd
+  when: evolinux_root_disable_ssh
+
 - meta: flush_handlers