Fix Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass

[lamcodeofpwnosec]

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

CVE-2024-45337
CWE-285

[github-actions]

Thank you for your submission. We really appreciate it. Before we can accept your contribution, we ask that you sign the Mondoo Contributor License Agreement. You can sign the CLA by adding a new comment to this pull request and pasting exactly the following text.

---

I have read the Mondoo CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}