[PM-41898] SSH Agent v2: add per-key destination filtering

[V1rg1lee]

🎟️ Tracking

Related to #13401

GitHub Discussion: https://github.com/orgs/bitwarden/discussions/22382

Community feature request:
https://community.bitwarden.com/t/ssh-agent-allow-specifying-limiting-private-key-offers/79954

📔 Objective

The SSH agent can expose enough identities for an SSH server to hit MaxAuthTries before OpenSSH reaches the correct key.

This PR adds optional per-key destination filtering to SSH Agent v2 using the verified host-key fingerprint already provided by OpenSSH through session-bind@openssh.com.

SSH key items on Desktop can now be associated with one or more SHA256 host-key fingerprints. These settings are stored locally on Desktop and are not added to synchronized cipher data.

When a verified destination is available, the agent returns identities in this order:

1. keys explicitly configured for the destination;
2. unrestricted keys with no destinations configured.

Keys restricted to other destinations are omitted. Ordering within each group remains stable.

If no verified session binding is available, all identities are returned as before.

This allows a user to configure only the key they expect to use for a server and have it prioritized ahead of unrestricted Bitwarden identities, without requiring every other key to be configured first.

The destination setting is an identity-offering optimization, not an authorization boundary. This PR does not add hostname/IP matching, host-key discovery, ssh-keyscan, or changes to signing authorization.

🧪 Testing

Automated testing includes:

• Rust unit and integration coverage for destination matching, filtering, prioritization, stable ordering, serialization, and the no-session-bind fallback.
• Desktop/UI tests for local persistence, Save/Cancel behavior, validation, new-cipher persistence, and removal of destination restrictions.
• cargo fmt --check
• cargo check -p desktop_napi
• node scripts/lint-rust.mjs --only clippy
• Relevant Jest and TypeScript checks
• ESLint and Prettier checks

Manual end-to-end testing was performed against a real OpenSSH server on Windows.

Before this change:

• the Bitwarden agent returned 6 identities;
• the correct key was reached too late;
• the server disconnected with Too many authentication failures.

After configuring only the correct key for the destination and leaving the other keys unrestricted:

• OpenSSH successfully bound the agent connection to the server host key;
• the destination-matched Bitwarden identity was prioritized ahead of unrestricted Bitwarden identities;
• the server accepted the correct RSA key and public-key authentication succeeded.

I also tested the stricter case where unrelated keys were restricted to other destinations. In that case, the agent returned only the matching identity.

📸 Screenshots

Configured destination

Validation

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-41898
Link: https://bitwarden.atlassian.net/browse/PM-41898

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

[djsmith85]

Thank you for your contribution @V1rg1lee! The Desktop-Native product team will evaluate your contribution and discuss with the engineering team

Platform-owned changes are limited to the updated napi-file. @bitwarden/team-desktop-native-dev can re-request a review once they are happy with the proposed solution.