ssh: add ssh_pubkey_algorithms variable

[fmcglinn]

Pre-Request Checklist

• Passes rubocop code analysis (try rubocop --auto-correct)
• Tests added or adapted (try rake test) (no test: a spec could only assert the option reaches Net::SSH.start, which is Net::SSH's behaviour, not Oxidized's)
• Model changes include a YAML simulation file
  and the expected output (no model change)
• Changes are reflected in the documentation
• User-visible changes appended to CHANGELOG.md

Description

Adds an ssh_pubkey_algorithms variable. It is passed to Net::SSH as pubkey_algorithms, in the same way that ssh_kex, ssh_encryption, ssh_host_key and ssh_hmac are passed today.

Why: Net::SSH (>= 7.1) signs with an RSA key using rsa-sha2-512/rsa-sha2-256 first. It falls back to ssh-rsa only after the server rejects those. Some devices don't reject them properly:

• Huawei SmartAX MA5683T OLTs accept the key (SSH_MSG_USERAUTH_PK_OK), then close the connection when they receive the rsa-sha2-256 signature: disconnected: The connection is closed by SSH Server / Current FSM is SSH_Main_SSHProcess (2). Because it is a disconnect and not an auth failure, neither the ssh-rsa fallback nor the password auth method ever runs, and the node fails with no_connection. Running Net::SSH directly with pubkey_algorithms: %w[ssh-rsa] logs in fine. The SmartAX does not support ed25519 keys, so an RSA key with ssh-rsa is the only key-based option.
• In Add the ability to configure pubkey_algorithms following Net:SSH 7.1.x upgrade #2875, a device logged a failed login on every backup before the fallback succeeded.

Until now, both cases needed a patch to the SSH input. With this change it is a per-model or per-node var:

models:
  smartax:
    vars:
      ssh_pubkey_algorithms: ssh-rsa

When the var is unset, behaviour is unchanged. The option only affects RSA keys; Net::SSH ignores it for other key types.

Changes:

• lib/oxidized/input/sshbase.rb: map ssh_pubkey_algorithms (comma-separated) to pubkey_algorithms, and re-align the sibling ssh_* lines (whitespace only)
• docs/Inputs.md: new "SSH public key algorithms" section, including a note that it only applies to RSA keys
• CHANGELOG.md: entry under Unreleased / Added

Testing:

• bundle exec rake test: 413 runs, 0 failures.
• bundle exec rubocop: no offenses.
• Manual: SmartAX MA5683T backs up with ssh_pubkey_algorithms: ssh-rsa; without it the node fails with no_connection.

Closes #2875

[ytti]

Not sure the test does anything. You might want to ask the instance that the PubkeyAcceptedAlgorithms are as set as expected. However tests are not mandatory either, but I'm not sure there is value in no-op tests.

[fmcglinn]

Fair comments - at some point the tests become about testing Net::SSH rather which introduces fragility. Ive dropped the test and updated the PR.
Let me know if you have any other feedback, happy to adjust as needed :)