v0.22.1: source-address certificates accepted under ssh_domains, from their own address

With ssh_domains set (v0.22.0), a certificate carrying the source-address critical option was refused even from an address it allows, because the SFTP server's certificate path refused every critical option. go-filesystems/sftp v0.5.1 (go-filesystems/sftp#20) accepts and enforces it there:

• such a certificate is let in from its own address only, on the trusted_user_ca_file and OIDC ssh_ca_file paths alike;
• every other critical option is still refused.

This means go-authn/bridge v0.19.0 certificates issued with ssh_source_address work under ssh_domains.

Tested with ssh-keygen-signed certificates through the OpenSSH sftp client; against sftp v0.5.0 the same test fails.

Dependencies: go-filesystems/sftp v0.5.1, go-filesystems/interface v0.4.0.