public_key_algorithms is validated per connection instead of at startup

Summary

An invalid entry in public_key_algorithms is not rejected at startup. It is validated on every incoming connection, so gitlab-ctl reconfigure succeeds, gitlab-sshd starts and reports healthy, and then every SSH connection fails.

Detail

internal/sshd/server_config.go assigns the configured list straight to ServerConfig.PublicKeyAuthAlgorithms with only a length check:

func (s *serverConfig) configurePublicKeyAlgorithms(sshCfg *ssh.ServerConfig) {
	if len(s.cfg.Server.PublicKeyAlgorithms) > 0 {
		sshCfg.PublicKeyAuthAlgorithms = s.cfg.Server.PublicKeyAlgorithms
	}
}

Validation happens later, per connection, in x/crypto/ssh NewServerConn:

for _, algo := range fullConf.PublicKeyAuthAlgorithms {
    if !slices.Contains(SupportedAlgorithms().PublicKeyAuths, algo) && !slices.Contains(InsecureAlgorithms().PublicKeyAuths, algo) {
        c.Close()
        return nil, nil, nil, fmt.Errorf("ssh: unsupported public key authentication algorithm %s", algo)

NewServerConn is called from internal/sshd/connection.go, so the failure recurs for every client and the server never signals a problem at boot.

This also differs from kex_algorithms, ciphers, and macs, which are silently filtered rather than rejected. The inconsistency makes the behaviour hard to predict.

Verified against gitlab-shell 14.56.1 with golang.org/x/crypto v0.54.0.

Expected

Validate public_key_algorithms when the server config is built, and refuse to start with a clear error naming the offending algorithm. A typo in one setting should not produce a total Git-over-SSH outage that only appears after the operator has walked away from a successful reconfigure.

Context

Found while documenting these settings in gitlab!252085 (merged).