Reject unrecognized kex, cipher and MAC names at startup

What does this MR do and why?

x/crypto's SetDefaults drops any entry in kex_algorithms, ciphers or macs that it does not recognize, and when nothing is left it restores its full default list. A mistyped hardening list therefore produced a more permissive server than the defaults, SHA-1 MACs included, with no error and no warning.

This MR runs SetDefaults on a probe config when the server config is built and refuses to start if any configured name was dropped, naming the setting and the value (unsupported algorithm in macs: "bogus-mac"). Asking x/crypto which names it accepts, rather than keeping a list here, means aliases such as curve25519-sha256@libssh.org and legacy names such as hmac-sha1 are still accepted exactly as before. A table test covers a typo in each list plus a valid mixed list.

This sits next to the public_key_algorithms check in !1555 (merged); whichever merges second I will rebase.

References

• Resolves #870

Differences

Before: macs: [bogus-mac] starts gitlab-sshd offering all six default MACs, including hmac-sha1.

After: gitlab-sshd exits at startup with unsupported algorithm in macs: "bogus-mac".

How to set up and validate locally

1. Add a misspelled entry to sshd.macs in config.yml and start gitlab-sshd.
2. go test ./internal/sshd/ -run TestNewServerConfig_RejectsUnrecognizedAlgorithms.