Proxy SSH certificates via ssh-agent-lib 0.6 PublicCredential (fix #56)

[sini]

Summary

Fixes #56: an SSH certificate in any upstream agent made the mux unusable — ssh-add -l returned incomplete message, and with #94 merged it instead silently dropped every other agent's keys.

ssh-agent-lib 0.5.1 typed identities as ssh_key::public::KeyData, which cannot represent an OpenSSH certificate. request_identities decoded a …-cert-v01@openssh.com blob into a lossy opaque key (only the certificate nonce survived) and re-serialized a truncated identity, so an OpenSSH client parsing it back as a certificate ran out of bytes.

This bumps to ssh-agent-lib 0.6.0, whose PublicCredential (Key(KeyData) | Cert(Box<Certificate>)) round-trips certificates losslessly in both identity listings and sign requests. The known_keys map is now keyed by credential.key_data(), so a certificate, its bare public key, and the sign request OpenSSH issues all resolve to the same upstream agent.

Scope / ssh-key 0.7

ssh-agent-lib 0.6.0 builds on the released ssh-key 0.6.7 — no pre-release or patched dependency. Certificates with a real valid_before (as OpenSSH and correctly configured issuers produce) round-trip fine.

The one remaining gap is certificates minted with valid_before = u64::MAX (Valid: forever): ssh-key 0.6.7 rejects those with SSH key error: invalid time (RustCrypto/SSH#504, fixed in ssh-key 0.7). That is an ssh-key limitation, not the mux — and arguably such certs should not be minted (a certificate that carries an expiring token's authorization should expire with it; see openpubkey/opkssh#606).

Testing

Verified against real certificates:

• ssh-add -l through the mux lists both the bare key and the …cert-v01@openssh.com certificate (previously incomplete message).
• ssh-add -T signs through the mux for both the key and the certificate, routing to the upstream that holds it.

The certificate integration test added in #66 exercises this path.