fix(linux-ssh): offer no key replace under StrictHostKeyChecking yes

[datlechin]

Why

When a tunnel's host key changed, the review offered Replace. Under StrictHostKeyChecking yes, Replace removed the old key and the retry then stopped on an unknown key the app may not trust, so the user lost the key for nothing. The connect error for an unknown key under strict config also read "(key )" and told the user to review the key in the app, which the config does not allow.

Change

• HostKeyChanged carries trust_allowed, from the ssh -G lookup the connect already runs for the destination and each jump host. It is false when that host's own config says yes.
• Under strict config the review offers Close and Retry and says to replace the key in known_hosts outside the app first, naming the file and line when ssh gives them. ask, accept-new, no, unset and a failed lookup behave as before.
• The unknown-key error says the config accepts only keys already in known_hosts. With no fingerprint, it never shows an empty key.

Verified

• Docker: a changed key under yes is reported as not trustable and ssh then refuses without asking; a jump host's own config decides; ask, accept-new and no still allow trusting.
• Unit tests run real ssh -G for all five values. The banner test offers no Replace. The error text test failed before with "(key )".
• All 19 ssh Docker tests and the full gtk suite pass.