allow key managemant to be allowed via --mgmt / --mgmt-confirmed

[tiwe-de]

this will need code for those commands:

• SSH2_AGENTC_ADD_IDENTITY
• SSH2_AGENTC_REMOVE_IDENTITY
• SSH2_AGENTC_REMOVE_ALL_IDENTITIES
  and perhaps
• SSH_AGENTC_LOCK
• SSH_AGENTC_UNLOCK

this also means introducing synchronization between threads for managing the filter data structures

policy for non-confirmed operation needs to be decided:

• add new keys to the filter?
• add adds existing-but-filtered key to the whitelist?
• …