Add SshAgentServer for hosting keys over the agent protocol

[darinkes]

Summary

Adds SshAgentServer, a minimal in-process ssh-agent. It holds SSH.NET keys and answers the agent protocol — identity listing and signing — over a unix domain socket (off Windows) or a Windows named pipe, so any SSH client (this library's own SshAgent, ssh, git, …) can use keys hosted by a .NET process. Because signing is done in-process with the loaded keys, the key material can come from anywhere the process can reach: a file, a freshly generated key, or an HSM/Key Vault wrapper.

This turns the library from an agent client into a small agent toolkit, and is the building block for Key Vault-backed agents, Pageant replacements and WSL↔Windows bridges.

API

var server = new SshAgentServer(params IPrivateKeySource[] keys);
server.Add(IPrivateKeySource key);
server.Remove(IPrivateKeySource key);
server.Start(string endpoint);   // socket path off Windows, pipe name on Windows
server.Dispose();                // stops listening
string? server.Endpoint { get; }

Protocol coverage

• SSH2_AGENTC_REQUEST_IDENTITIES → lists the held keys (empty while locked)
• SSH2_AGENTC_SIGN_REQUEST → signs with the matching key, honouring the RFC 8332 RSA sha2 sign flags
• SSH2_AGENTC_REMOVE_IDENTITY / REMOVE_ALL_IDENTITIES
• SSH_AGENTC_LOCK / UNLOCK
• other requests (including ADD_IDENTITY) → SSH_AGENT_FAILURE

Keys are managed through the .NET API; pushing a key in over the protocol (ssh-add) is intentionally out of scope for now. Unix domain sockets need the netstandard2.1 or .NET build (same as the client).

Tests

SshAgentServerTests drives the server through the library's own SshAgent client over a real socket/pipe:

• identity listing returns the right blob and comment
• signing round-trips and the signature verifies against the public key for RSA, ECDSA (nistp256) and Ed25519
• lock hides identities until unlocked; wrong passphrase is rejected
• remove and remove-all

Full suite: 53 passed, 18 environment-skipped (Docker / Pageant / OS agent), 0 failed. All target frameworks build.