feat: not fail on non-default ports - #6895

Description

SSHKeyScan builds a known_hosts entry from the scanned host key but
discards the port, always emitting a bare hostname:

hostname, _, err := net.SplitHostPort(hostport)
...
key = fmt.Sprintf("%s %s", hostname, ...)

For a server reachable on a non-standard port (e.g. git.example.com:2222)
this stores the key under git.example.com, but ssh looks it up under
[git.example.com]:2222 per the SSH_KNOWN_HOSTS format in sshd(8). The
entry never matches, so host-key verification fails for any git source or
SSH endpoint on a non-22 port.

Fix

Render non-standard ports as [host]:port; keep the default port (22) as a
bare hostname (matching ssh-keyscan and the known_hosts format). The
formatting is extracted into a small pure helper, knownHostsServerID, which
is unit-tested directly (a full SSH handshake is impractical to fake in a
unit test).

Test

go test ./util/sshutil/ — new table test covers default port, empty port,
non-standard port, and IPv6 (default and non-standard).