[shim] Mark authorized_keys entries added by the shim

[un-def]

The shim appends the host SSH keys of a task to the host user's authorized_keys when the task starts and removes them when it ends, keeping no record of which entries it added. Removal therefore has to match by fingerprint alone, which also drops identical entries the shim did not add. Once tasks survive a shim restart, the shim will not be able to tell them apart at all, since the process that added an entry is no longer necessarily the one that removes it.

Added entries now carry a # added by dstack-shim comment, mirroring the # added by dstack marker the server writes when provisioning SSH fleets. sshd ignores everything after the key blob, so the marker does not affect authentication.

Nothing honors the marker yet -- keys are still removed by fingerprint regardless of the comment, so the behavior for the entries already in the file is unchanged. It is written now so that, by the time removal does honor it, the entries added by earlier shim versions are already marked, as an unmarked entry could never be removed. Until tasks become restart-safe, a task is always started and finalized by the same shim process, so there is no handoff between versions to protect.

• The marker goes into the comment field, therefore the entry it is added to has to be a single well-formed key line. Entries are now parsed and the line is re-serialized from the parsed key, and an entry that is not exactly one bare public key -- more than one key, or one carrying authorized_keys options, which are not part of the on-disk public key format -- is skipped with an error in the log instead of being written as is.
• Entries are validated one by one, so an invalid one no longer keeps the rest out of the file. A task whose key is rejected starts without host SSH access.

Notes:

• Honoring the marker on removal, refcounting the keys shared by co-located tasks, and making the file update atomic are a separate change, which needs the per-task state file: Make shim tasks survive a shim restart (rework DockerRunner.Run()) #4182

Part-of: #4174