ssh: enforce source-address critical option for all auth methods

[al4an444]

CVE-2026-46595 (CL 781642) added the source-address critical-option check
to the publickey path's VerifiedPublicKeyCallback branch in userAuthLoop.
The other auth methods that return *Permissions ("none" via
NoClientAuthCallback, "password" via PasswordCallback,
"keyboard-interactive" via KeyboardInteractiveCallback, and
"gssapi-with-mic") still return their Permissions to the caller without
validating the remote address against CriticalOptions["source-address"].

The Permissions struct documentation states the package enforces the
source-address critical option, with no caveat that this is limited to
publickey. A server that sets the restriction from any non-publickey
callback (password auth scoped to a corporate range, keyboard-interactive
2FA, GSSAPI SSO, or break-glass none auth) currently gets no enforcement
and no warning to the operator.

This moves the enforcement to a single check after the auth-method switch
so it applies uniformly to every method. The existing publickey-path
checks are left in place as defense in depth.

A regression test (TestSourceAddressCriticalOptionNonPublicKey) covers the
none/password/keyboard-interactive methods; it fails on master and passes
with this change. The existing publickey control
(TestVerifiedPubKeyCallbackSourceAddress) continues to pass.

Updates golang/go#79570

[gopherbot]

This PR (HEAD: 798f67c) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/crypto/+/787860.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from Gopher Robot:

Patch Set 1:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/787860.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Nicola Murino:

Patch Set 3:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/787860.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Alan:

Patch Set 3:

(2 comments)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/787860.
After addressing review feedback, remember to publish your drafts!