openssh: apply CVE-2018-20685 patch

[andir]

Motivation for this change

@samueldr mentioned in #nixos-security (IRC) that there exists an issue with SCP (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919101; variant 1 from https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt).

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

[andir]

@GrahamcOfBorg test openssh
@GrahamcOfBorg build openssh openssh_hpn openssh_gssapi

[samueldr]

Relevant discussion mentioned in the PR

• https://logs.nix.samueldr.com/nixos-security/2019-01-13#1547406865-1547406871;

[vcunat]

The rebuild amount sounds OK for a security fix – < 6k for all platforms together.

[vcunat]

The tests succeeded for me locally (x86_64-linux) and on aarch64.nixos.community.

[andir]

Thanks for reviewing!