[stephahart]

Validate the CA public key and node/user principal components before writing authorized_keys. Reject extra keys, key options, control characters, and principal patterns; serialize the parsed public key so server comments cannot inject entries.

Validation: go test ./pkg/cmd/enablessh -timeout 3m passes, including injected-key/principal cases that verify authorized_keys remains unchanged.

Fixes https://linear.app/nvidia/issue/BRE2-1286

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.01%. Comparing base (6c85c4e) to head (e4e2e1f).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #528      +/-   ##
==========================================
+ Coverage   33.51%   38.01%   +4.50%     
==========================================
  Files         153      136      -17     
  Lines       21654    20118    -1536     
==========================================
+ Hits         7257     7648     +391     
+ Misses      13624    11675    -1949     
- Partials      773      795      +22     

Flag	Coverage Δ
Linux	38.01% <100.00%> (+4.50%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.