Open external port into ipFire firewall?

The cgi code has been set up so that when you press the save button the sshd_config file is rewritten from scratch to have all the settings as specified in the WUI page defined. Therefore the whole file is rewritten every time you do a save.
EDIT:
This statement is incorrect. I had presumed this but not confirmed it by looking at the code. I have now looked at the code and the sshd_config file has a c based program called sshctrl that finds the lines with Port in them and changes them based on the settings on the WUI page. The same is done for Protocol, PubKeyAuthentication, AllowAgentForwarding etc. Then the sshd daemon is restarted.
This means that additions made to the file are not all overwritten. So adding an Include line to sshd_config stays in place. sshd_config is also backed up so that line will also stay in place with Core Updates. You would just need to add the file that you want to be included into the include.user file so that it is backed up.

This is the same for the DHCP and OpenVPN config files and I would expect, although not confirmed personally by looking at the code, that all config files for the WUI pages are treated in that manner.

What the DHCP and the OpenVPN configuration allow is to have include files, or to have the contents of a specific local file added to the end of the configuration file.

Currently there is no include file option available with the SSH WUI code.

You would be welcome to modify the code to have an include file added to the sshd_config and create and submit a patch for that to the IPFire development team.

https://wiki.ipfire.org/devel/ipfire-2-x/build-howto
https://wiki.ipfire.org/devel/submit-patches