fix(cli): use local ssh client for vm access

[LopatinDmitr]

Description

Remove the embedded native SSH/SCP implementation from the virtualization CLI.

d8 v ssh and d8 v scp now always use the local OpenSSH/SCP clients through d8 v port-forward --stdio=true as ProxyCommand.

This change also:

• adds --ssh-opts for passing additional options to the local SSH/SCP client;
• keeps --local-ssh as a deprecated no-op compatibility flag;
• keeps --local-ssh-opts as a deprecated alias for extra SSH/SCP client options;
• passes --identity-file/-i directly to OpenSSH/SCP as -i;
• maps --known-hosts to OpenSSH UserKnownHostsFile;
• updates CLI docs, user guides, and e2e helpers.

Why do we need it, and what problem does it solve?

The native SSH implementation does not fully match OpenSSH behavior.

One observed issue is authentication with an explicit identity file when SSH_AUTH_SOCK is set. The native client tries ssh-agent first. If the agent key is rejected, golang.org/x/crypto/ssh marks the publickey method as already tried and the explicitly provided --identity-file key is skipped. As a result, d8 v ssh -i <key> may fall back to password authentication or fail completely, while d8 v ssh --local-ssh -i <key> works.

Using local OpenSSH/SCP as the only implementation makes authentication behavior consistent with users' expectations and supports local OpenSSH configuration, agent behavior, certificates, and client options.

What is the expected result?

1. Run d8 v ssh user@vm -i /path/to/key while SSH_AUTH_SOCK is set and contains unrelated keys.
2. Verify that the command authenticates using the explicitly provided key through local OpenSSH.
3. Run d8 v scp -i /path/to/key ./file user@vm:/tmp/file and verify that SCP uses the same local-client path.
4. Run commands with deprecated --local-ssh or --local-ssh-opts and verify that they still work and print deprecation warnings.
5. Run d8 v ssh user@vm --known-hosts /path/to/known_hosts and verify that OpenSSH uses it as UserKnownHostsFile.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: fix
summary: Use local OpenSSH and SCP clients for virtual machine SSH and SCP access.
impact_level: low