SSH: fall back to default identity files when agent lacks the key

[roblourens]

Switch SSH auth in SSHRemoteAgentHostMainService to ssh2's authHandler callback, walking an ordered queue of attempts:

1. Explicit privateKeyPath (if set)
2. SSH agent (if SSH_AUTH_SOCK is set)
3. Each existing default identity file (~/.ssh/id_ed25519, id_rsa, id_ecdsa, id_dsa, id_xmss), deduped against the explicit key

This mirrors OpenSSH client behavior: a host that accepts ~/.ssh/id_rsa still connects when the agent is running but doesn't have the key loaded — without needing an explicit `IdentityFile` entry in `~/.ssh/config`.

Other changes

• Imported proper `ConnectConfig` typings from `ssh2` instead of `Record<string, unknown>`. Added `'ssh2'` to the eslint node-modules allow list.
• Simplified `reconnect()` — always Agent mode; only forwards `privateKeyPath` for non-default `IdentityFile` entries.
• New protected test seams: `_buildAuthAttempts`, `_isAgentAvailable`, `_readKeyFileIfExists`.
• Replaced old per-method tests with snapshot-style `_buildAuthAttempts` cases (8) and a `makeAuthHandler` suite (2). All 42 tests pass.

Manual smoke (TODO before merging)

• `ssh-add -D` (empty agent), connect via "Add Remote Agent Host via SSH..." → log shows `agent` then `publickey ~/.ssh/id_rsa`, succeeds.
• Agent has the right key → succeeds on `agent`.
• No `SSH_AUTH_SOCK` → falls through to default keys.
• Explicit `privateKeyPath` → tried first.
• Restart / reconnect path still works.

(Written by Copilot)

[Copilot]

Pull request overview

Updates the SSH remote agent host connection logic to more closely match OpenSSH key fallback behavior by using ssh2’s authHandler with an ordered list of authentication attempts, and adjusts tests/linting accordingly.

Changes:

• Switch _connectSSH to build an ordered auth-attempt queue and use a new makeAuthHandler to drive ssh2 authentication.
• Refactor reconnect logic to always use Agent auth mode while optionally surfacing a non-default IdentityFile as an explicit key attempt.
• Replace prior auth-config tests with _buildAuthAttempts and makeAuthHandler unit tests; allow ssh2 in ESLint config.

Show a summary per file

File	Description
src/vs/platform/agentHost/node/sshRemoteAgentHostService.ts	Introduces auth-attempt queue + authHandler, reconnect simplification, and new test seams for agent/key-file access.
src/vs/platform/agentHost/test/node/sshRemoteAgentHostService.test.ts	Reworks tests to validate _buildAuthAttempts ordering and makeAuthHandler iteration/filters.
eslint.config.js	Allows importing ssh2 by adding it to the node-modules allow list.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 3