Firewall: Add command-line tool to rules (mosh-server)
I knew I was being dumb: in the Finder dialog that pops up, press Shift+⌘+G and enter /usr. From there I can browse to the binary.

Turns out this is a completely ordinary Finder shortcut for "Go to folder".