feat(ssh): support FIDO security keys through SecurityKeyProvider - #333

bssh did not list the sk-* key types, so the regress harness never generated sk-* host keys and the two sk-*-cert-v01@openssh.com phases of hostkey-agent could not pass. Listing them makes every regress test add sk-* IdentityFile lines, so user authentication with authenticator-hosted keys had to work too. This follows OpenSSH 10.3p1 built without its internal provider.

SecurityKeyProvider becomes a runtime option (library path, internal, none, or $VAR; default $SSH_SK_PROVIDER, printed raw by -G). src/ssh/security_key holds the SecurityKeyProvider trait that #331 will plug internal into, $VAR resolution, the dlopen binding to sk-api 0x000a0000 with every provider pointer validated and the response freed as ssh-sk.c does, and the sk-* signature encoder. The provider is loaded in process instead of through an ssh-sk-helper style subprocess: bssh has no pledge sandbox to keep the middleware out of, and a re-exec helper would add a private protocol without changing what runs as the user. Provider calls run on a blocking thread, the touch notice is printed when stderr is a terminal, and a PIN is prompted once outside BatchMode. A provider that cannot be opened is reported before the identity is offered and authentication continues; a sk_sign failure after the server asked for the signature ends the transport, like LocalSignerFailed. Static musl builds compile and name the dlopen limitation.

sk-* identities sign through a russh Signer for plain keys and user certificates; agent-held keys keep using the agent. -Q and the default HostKeyAlgorithms and PubkeyAcceptedAlgorithms match the reference order except for the webauthn-sk-* pair, which bssh cannot verify. A regression test keeps a certificate-only HostKeyAlgorithms list from being widened.

Validation: hostkey-agent, keytype, limit-keytype and agent pass locally with the regress sk-dummy provider; connect, proxy-connect and hostkey-rotate still pass. Unit tests cover $VAR expansion, the internal diagnostic, load failures, signature encoding, the algorithm lists and the signer, and each fails when its behavior is reverted.

Refs #328

SecurityKeyProvider now has a runtime consumer, so the compat-output test can no longer use it as the example of a parsed-but-unimplemented option. The fixture now uses VisualHostKey at the same line for the once-only unsupported diagnostic, keeps a SecurityKeyProvider line, and asserts that it produces no unsupported diagnostic.

Validated with cargo test --test ssh_compat_output_test and cargo test --test ssh_config_dump_test.

Refs #328

PROVIDER_CALL_LOCK was a std mutex taken inside each spawn_blocking task. In multi-host mode every host queued behind a touch pinned its own blocking thread, so with --parallel above tokio's blocking-pool limit the pool filled up and tokio::fs and DNS work for every connection, including ones without security keys, stalled until the touches drained. A connection that hit ConnectTimeout while queued also kept its blocking task, which later called sk_sign anyway and asked the user to touch the key for a connection that no longer existed, holding the lock and pushing the remaining hosts toward their own timeouts.

The lock is now a FIFO tokio mutex acquired before spawn_blocking; the owned guard moves into the blocking task, so a dropped future still cannot release it while the provider runs. A queued waiter that is cancelled leaves the queue without reaching the provider. The touch notice is printed once the identity holds the provider, on every attempt as identity_sign does, so it matches the authenticator that is actually waiting.

Two new tests fail with the previous lock: a cancelled queued signer must never reach the provider, and queued signers must leave a two-thread blocking pool free for unrelated spawn_blocking work.

Refs #328

russh 0.64.1 verifies the exchange signature with whatever key the server sends, and check_server_key never compared it with the negotiated host-key algorithm, so a HostKeyAlgorithms restriction (including one that excludes sk-*) did not limit which trusted key type a server could use. OpenSSH's kex_verify_host_key rejects this with SSH_ERR_KEY_TYPE_MISMATCH.

kex_done now records Names::key, and check_server_key refuses a key whose type differs before any known_hosts or StrictHostKeyChecking decision, with a new HostKeyTypeMismatch error. Signature names map to their key type (rsa-sha2-256/512 select RSA), ECDSA curves must match, and sk types match only themselves. russh records only the plain algorithm and keeps the certificate flag private, but it parses the blob as a Certificate exactly when a certificate was negotiated, so the certificate half comes from that variant and certificate key data in the plain-key slot is refused. A key received before kex_done fails closed. The existing policy body moved to verify_server_key, which the policy tests now call directly.

Tests cover RSA under every rsa-sha2 name, Ed25519 under ECDSA, curve mismatch, certificate versus plain in both directions, sk types, and the handler path; each fails with the check reverted.

Refs #328