Which rule type controls end user SSL traffic to external websites?

SSL Inbound Inspection is used for decrypting and inspecting SSL traffic that is destined for internal servers within the protected network, not for outbound user traffic.

SSH Proxy is a feature designed for decrypting and inspecting SSH (Secure Shell) traffic, which is distinct from SSL/TLS web traffic.

SSL Forward Proxy decryption intercepts and decrypts outbound SSL/TLS traffic initiated by internal users accessing external websites. The firewall acts as an intermediary, generating a new certificate for the destination site to allow full inspection of the encrypted payload.

'SSL Outbound Proxyless Inspection' is not a standard or recognized rule type for decrypting and inspecting outbound SSL traffic on Palo Alto Networks firewalls; the correct term for proxying is SSL Forward Proxy.