WIP: CertAuthority principal support

[jage]

Implement principal verification for certificates.

The connecting client must verify that it is connecting to the correct server by verifying that the certificate is from a trusted authority (already implemented in Net-SSH), but this implements the verifications of the principal, i.e. matching hostname we are connecting to and certificate, and also validity for the certificate.

Without this a bug or attack could cause a connection to be redirected to another server signed by the same certificate authority, without the client knowing.

Example data from host certificate.

ubuntu@dev-eager-red-fish-01:/etc/ssh$ ssh-keygen -L -f ssh_host_ed25519_key-cert.pub
ssh_host_ed25519_key-cert.pub:
        Type: ssh-ed25519-cert-v01@openssh.com host certificate
        Public key: ED25519-CERT SHA256:QpdPXoI3aHXKbDrGeFUV+qPryfFJ6Qj95H1bf/kkb9E
        Signing CA: ED25519 SHA256:fcgMyZZM0Oo7rp+LHFcuWTLh3rBpyJOyHWRD4ULqigA (using ssh-ed25519)
        Key ID: "dev-eager-red-fish-01.rmq6.dev.cloudamqp.com"
        Serial: 0
        Valid: from 2024-03-15T13:19:00 to 2024-06-13T13:20:56
        Principals:
                dev-eager-red-fish-01.rmq6.dev.cloudamqp.com
        Critical Options: (none)
        Extensions: (none)

---

DO NOT MERGE THIS.

Just want a PR to run CI right now.

• Test expired certificate
• Test certificate without any principal listed