Adds SSHPolicyTest with typed Alias src, SSHTestDestinations dst, and []SSHUser accept/deny/check. Parse rejects empty assertions, port/CIDR/autogroup-internet destinations, and empty user.