Support instance-level results from /authorized_certs

/authorized_certs now returns an instance boolean identifying the scope of a match. This change is to begin using that attribute.

Omit the namespace extension when instance is true, and apply validateKeyID to those responses, since they resolve KeyId to a username just as locally trusted CAs do. That check runs after the API call because group-level resolution accepts an email identifier, which the pattern rejects.

Also reject a group-scoped response with a blank namespace, an instance-scoped one carrying a namespace, or any response with a blank username. Blank values are Go zero values, a blank namespace is indistinguishable downstream from an absent one, and Rails never mixes the two scopes' fields, so failing closed keeps a Rails bug from granting instance-wide access.

Both instance-wide paths, a locally trusted CA and an instance-scoped response, share validateInstanceKeyID and grantCertificate, so they apply the same KeyId rules and build the same permissions.

Related to #867 (closed)

Validation Steps

• Generate key for the instance: ssh-keygen -t ed25519 -f /tmp/ca -N '' -C 'test-instance-ca'
• configure gdk with these:

env:
  GITLAB_SIMULATE_SAAS: '0'
  FF_GITLAB_SHELL_SSH_CERTIFICATES: '1'

• gdk restart sshd
• In rails: Create a InstanceSshCertificate using the generated key

Feature.enable(:instance_ssh_certificates)
key = File.read('/tmp/ca.pub')
InstanceSshCertificate.create!(title: 'test CA', key: key,
  fingerprint: Gitlab::SSHPublicKey.new(key).fingerprint_sha256.delete_prefix('SHA256:'))

• Create a private project as some user (e.g alexandra) Create CA keys and issue certificate to a user for testing (https://docs.gitlab.com/administration/operations/gitlab_sshd_ssh_certificates/#issue-ssh-certificates-for-users):
  • Generate User key: ssh-keygen -t ed25519 -f /tmp/user -N '' -C 'cert-user'
  • Generate User cert using the registered key with the project owner's username as the key id: ssh-keygen -s /tmp/ca -I alexandra -n git -V +1h /tmp/user.pub
    • gdk tail sshd to see that the response is parsed:
      • Watch gdk tail sshd for new the instance-level logs
        • Try cloning the project and see that the authentication worked

  GIT_SSH_COMMAND='ssh -i /tmp/user -o CertificateFile=/tmp/user-cert.pub -o IdentitiesOnly=yes -p 2222' \
  git clone git@gdk.test:alexandra/some-project.git /tmp/clone-check