sshserver.pl: pass command-line to system() safely

[vszakats]

Found by Codex Security

Follow-up to 89f306a #16781

[vszakats]

augment review

[Copilot]

Pull request overview

This PR hardens tests/sshserver.pl by switching ssh-keygen invocation from a shell-constructed command string to Perl’s list-form system() call, preventing shell interpretation of arguments (including those influenced by environment variables like CURL_TEST_SSH_KEY_FORMAT).

Changes:

• Build ssh-keygen optional arguments as an array (@sshkeygenopt) instead of concatenating into a string.
• Invoke ssh-keygen via list-form system($prog, @args) for both host and client key generation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[augmentcode]

🤖 Augment PR Summary

Summary: Hardens tests/sshserver.pl by avoiding shell-constructed ssh-keygen command lines and using list-form system() calls instead.

Changes: Builds -m <format> options as an argument array (defaulting to PEM for OpenSSH ≥5.6), preventing injection via CURL_TEST_SSH_KEY_FORMAT and improving quoting/whitespace handling when generating test keys.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.