Deployer appends known hosts rather than replacing them

[tomjn]

TLDR: the known hosts option implies it replaces the file, but it actually appends to it, which is not mentioned!

We've added the new github RSA fingerprints to a known hosts secret, along with several others, then told deployer to use it.

Unfortunately, deployer appends these to a known hosts file that has out of date fingerprints rather than replacing/overwriting, so we still get the SSH fingerprint problem despite adding the new entries.

As a workaround we're going to test removing all github fingerprints before running the deployer, but the documentation should be updated to make it clear that the action appends/extends, and does not replace/overwrite as currently implied