Document the new match criteria and negation support

Author: ronf

docs/api.rst

@@ -1647,7 +1647,9 @@ The following OpenSSH client config options are currently supported:
 For the "Match" conditional, the following criteria are currently supported:
 
   | All
+  | Canonical
   | Exec
+  | Final
   | Host
   | LocalUser
   | OriginalHost
@@ -1662,6 +1664,10 @@ For the "Match" conditional, the following criteria are currently supported:
                when options objects are created by AsyncSSH APIs such as
                :func:`connect` and :func:`listen`.
 
+Match criteria can be negated by prefixing the criteria name with '!'.
+This will negate the criteria and causing the match block to be evaluated
+only if the negated criteria all fail to match.
+
 The following client config token expansions are currently supported:
 
 .. table::
@@ -1734,7 +1740,9 @@ The following OpenSSH server config options are currently supported:
 For the "Match" conditional, the following criteria are currently supported:
 
   | All
+  | Canonical
   | Exec
+  | Final
   | Address
   | Host
   | LocalAddress
@@ -1750,6 +1758,9 @@ For the "Match" conditional, the following criteria are currently supported:
                when options objects are created by AsyncSSH APIs such as
                :func:`connect` and :func:`listen`.
 
+Match criteria can be negated by prefixing the criteria name with '!'.
+This will negate the criteria and causing the match block to be evaluated
+only if the negated criteria all fail to match.
 The following server config token expansions are currently supported:
 
 .. table::