pub fn validate_pubkey(pubkey: &str) -> Result<String>Expand description
M-3 (authorized_keys injection): validate that pubkey is a SINGLE, well-
formed ssh public-key line before it is ever written. A trusted+shell peer
could otherwise send a pubkey containing an interior \n (which .trim()
does NOT strip) to inject EXTRA authorized_keys lines, extra keys, a
command=/from= forced-command, etc. We reject anything with a control
character (newline, CR, tab, …) or more than one whitespace-separated key
line, and require the shape <key-type> <base64-blob> [single-line comment].
Returns the trimmed, validated single-line key on success.