Stop ssh from Offering Every Key with IdentitiesOnly

A login fails with "Too many authentication failures" before the right key is ever tried, because the agent holds a lot of keys.

cat > cfg <<'EOF'
Host work
  HostName work.example.com
  IdentityFile ~/.ssh/work_ed25519
EOF
ssh -F cfg -G work | grep -iE '^(identityfile|identitiesonly)'
echo ---
cat > cfg <<'EOF'
Host work
  HostName work.example.com
  IdentityFile ~/.ssh/work_ed25519
  IdentitiesOnly yes
EOF
ssh -F cfg -G work | grep -iE '^(identityfile|identitiesonly)'

identitiesonly no
identityfile ~/.ssh/work_ed25519
---
identitiesonly yes
identityfile ~/.ssh/work_ed25519

With the default IdentitiesOnly no, ssh offers the keys held by ssh-agent before the file named by IdentityFile, and every offer that the server refuses counts as an authentication attempt. A server that allows six attempts, the default for MaxAuthTries, closes the connection while the right key is still waiting. Setting the option to yes limits the offers to the configured files, as the ssh_config manual describes. ssh -G prints the configuration for the host without connecting, which confirms the value was picked up.

The option also applies to keys given with -i, and it ignores agent keys that are not in a file you name, so a key that lives only in the agent, as with a hardware token, needs its public key file listed as IdentityFile. It does nothing about a server with a low MaxAuthTries and several valid files in the list.