Replace Ganymed SSH with sshj in the JSystem automation harness

[Bonartze]

Why

The L2 (JSystem) automation suite cannot run on el9. The harness opened every system-object shell through JSystem's systemobject.terminal.SSH and our SshRsa subclass, both backed by Ganymed SSH2 (ch.ethz.ssh2), a 2006-era client whose handshake crypto stops at diffie-hellman-group1/group14-sha1 KEX and CBC ciphers. OpenSSH 9.x builds drop those algorithms at compile time, and sshd's +algo modifier can only re-enable what was built in, so Ganymed and an el9 sshd share no usable KEX/cipher and localhost:22 is unreachable for the harness. The packaging smoke works around it with an el8-only gate (IS_PXF_EL8), which leaves el9 with no JSystem signal.

What

• SshRsa now extends JSystem's Terminal directly and drives the shell with sshj 0.41.2 (Java 8 compatible): connect, authenticate, allocate a dumb PTY (same as Ganymed's requestDumbPTY(), so terminal-aware commands do not colour their output), start the shell, hand the channel streams to the Terminal. Password (password + keyboard-interactive) when the SUT gives one, otherwise the SUT's privateKey; sshj reads OpenSSH-format, PEM and PuTTY keys, so the OpenSSH→PEM conversion Ganymed needed goes away. Host keys are not verified (Ganymed's trust model).
• PxfCliConnectionImpl uses SshRsa for both the ssh and ssh-rsa protocols; nothing in the tree references JSystem's Ganymed-backed SSH any more.
• pom.xml: ganymed-ssh2 dropped as a direct dependency and excluded from org.jsystemtest.systemobjects:cli (its only remaining path); sshj added. Two knock-on effects of sshj's own dependencies pinned back:
  • slf4j-api held on 1.7.36 (sshj declares 2.0.17, which would ignore the only binding on the classpath, hadoop-common's slf4j-reload4j 1.7.36, and silence every Hadoop/HBase client log line);
  • the Bouncy Castle 1.68 jdk15on jars that hive-shims pulls via yarn web-proxy excluded, so the classpath carries one BC (sshj's jdk18on 1.84) instead of two copies of the same classes.
• automation/README.md: the SSH Setup section no longer asks for legacy KexAlgorithms/HostKeyAlgorithms in sshd_config or a PEM-format RSA key.

git grep -nE 'ch\.ethz\.ssh2|ganymed' automation/ now only hits the pom exclusion that removes it.

Verification

• mvn compile (Java 8) is green; mvn dependency:tree shows no ch.ethz.ganymed artifact.
• SshRsa driven the way PxfCliConnectionImpl does (connect → env PS1='#' bash --norc → command → prompt match → getResult() → disconnect) against two sshd containers, Rocky Linux 9 (openssh-server-9.9p1-12.el9_8) and Fedora 42 (openssh-server-9.9p1-14.fc42), each with an OpenSSH-format RSA key (-----BEGIN OPENSSH PRIVATE KEY-----, the format Ganymed could not read), an ed25519 key and a password: all six connect, the shell starts on the dumb PTY and the command output comes back through the Terminal. A wrong password fails with UserAuthException: Exhausted available authentication methods, as it should.
• com.aqua.sysobj.conn.CliConnectionImpl (which still references JSystem's SSH class) and PxfCliConnectionImpl load and link with ganymed-ssh2 off the classpath.