Add Ebury script

[dopheide-esnet]

Very simple script that attempts to detect an Ebury ssh backdoor infection.

[ckreibich]

Thanks Dop. There's a pre-commit CI setup in place for this repo that insists that the packages are alphabetically sorted. I just sorted it out during the merge — which would be better to do automatically...

[bbannier]

which would be better to do automatically...

@ckreibich The pre-commit hook sorts the files, and CI reports back a diff, so there should be casual guidance even for people who have not set up pre-commit for this repo locally. PRs by first-time contributors currently require approval which probably makes sense.

If you meant automatic fixing of PRs we could enable that by moving to pre-commit.ci to use their "autofix" feature. Until now I have shied away from that since it requires us giving write access to that action.