* docs: input format for default_critical_options and default_extensions

* s/sshca/ssh

* Added default_critical_options and default_extensions to the read endpoint of role

* Change default time return value to 0

Major changes are:
* Remove duplicate code
* Check the public key used to configure the backend is a valid one

Major changes are:
* Change `allow_{user,host}_certificates` to default to false
* Add separate `allowed_domains` role property