macOS SSH: a jump host's password can be saved as the destination's and sent to it #270

Found in release review of Kit for macOS 0.6.0 (Phase D SSH, #252). Holds the macos-v0.6.0 release until decided.

Problem

SSHAttempt.answer (apps/macos/Sources/Kit/Client/SSHHost.swift) keeps every password answer, whatever account the prompt names:

case .password: state.password = answer

The sign-in sheet offers Save in Keychain on every password prompt (SSHPrompt.saveable), including a ProxyJump host's ("Password for jump@bastion"). After the connection works, keep(destination:…) saves state.password under the destination. The next time the destination asks for a password, answer sends the saved one (the jump host's) to the destination. A bastion's password reaches another host.

Related: the retry counter is keyed only by "password", so the destination's first password prompt after a jump-host prompt says "That password didn't work."

Saved-password use is already restricted correctly (account == nil || account == self.account); only saving isn't.

Fix

• Store the answer as state.password, and offer Save in Keychain, only when the prompt's account is the login account (account == nil || account == self.account).
• Key the retry counter by the prompt's account.
• Test: a fake runner whose jump host and destination both ask; the saved item holds only the destination's answer, and a jump-host-only password is never saved.