Invalid input validation release

Apart from the usual set of dependency updates, this release adds some tests for invalid input with the goal of getting rid of the cases where invalid input would cause this code to panic. Since the ssh-agent that this code talks to is almost by definition trusted to do the right thing, the security implications of the previous state were not significant, but it still seems like a good idea to make sure that sending random data in responses doesn't kill the client, or make it allocate denial-of-service amounts of memory.