Remove `net-ssh`, `ed25519`, and `bcrypt_pbkdf` gems from dependencies

Follow up https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77424#note_812526274

In https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77424 we started
using `ssh_data` gem instead of `net-ssh` and `sshkey`
where possible to facilitate implementation of
https://gitlab.com/gitlab-org/gitlab/-/issues/213259.

This MR eliminates the last usage of `net-ssh` from the codebase
and removes `net-ssh` and its sub dependencies - `ed25519` and `bcrypt_pbkdf`.

Fewer dependencies facilitate development and maintenance,
especially during upgrading libraries/gems.

Changelog: other

Gemfile

@@ -466,16 +466,9 @@ gem 'sys-filesystem', '~> 1.4.3'
 # NTP client
 gem 'net-ntp'
 
-# SSH host key support
-gem 'net-ssh', '~> 6.0'
+# SSH keys support
 gem 'ssh_data', '~> 1.2'
 
-# Required for ED25519 SSH host key support
-group :ed25519 do
-  gem 'ed25519', '~> 1.2'
-  gem 'bcrypt_pbkdf', '~> 1.1'
-end
-
 # Spamcheck GRPC protocol definitions
 gem 'spamcheck', '~> 0.1.0'
 

Gemfile.lock

@@ -137,7 +137,6 @@ GEM
     base32 (0.3.2)
     batch-loader (2.0.1)
     bcrypt (3.1.16)
-    bcrypt_pbkdf (1.1.0)
     benchmark (0.1.1)
     benchmark-ips (2.3.0)
     benchmark-memory (0.1.2)
@@ -308,7 +307,6 @@ GEM
     e2mmap (0.1.0)
     ecma-re-validator (0.3.0)
       regexp_parser (~> 2.0)
-    ed25519 (1.2.4)
     elasticsearch (6.8.2)
       elasticsearch-api (= 6.8.2)
       elasticsearch-transport (= 6.8.2)
@@ -1408,7 +1406,6 @@ DEPENDENCIES
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
   bcrypt (~> 3.1, >= 3.1.14)
-  bcrypt_pbkdf (~> 1.1)
   benchmark-ips (~> 2.3.0)
   benchmark-memory (~> 0.1)
   better_errors (~> 2.9.0)
@@ -1441,7 +1438,6 @@ DEPENDENCIES
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.5.0.rc2)
   doorkeeper-openid_connect (~> 1.7.5)
-  ed25519 (~> 1.2)
   elasticsearch-api (~> 6.8.2)
   elasticsearch-model (~> 6.1)
   elasticsearch-rails (~> 6.1)
@@ -1542,7 +1538,6 @@ DEPENDENCIES
   multi_json (~> 1.14.1)
   net-ldap (~> 0.16.3)
   net-ntp
-  net-ssh (~> 6.0)
   nokogiri (~> 1.12)
   oauth2 (~> 1.4)
   octokit (~> 4.15)

app/validators/x509_certificate_credentials_validator.rb

@@ -41,7 +41,7 @@ class X509CertificateCredentialsValidator < ActiveModel::Validator
 
     return if private_key.nil? || certificate.nil?
 
-    unless certificate.public_key.fingerprint == private_key.public_key.fingerprint
+    unless certificate.check_private_key(private_key)
       record.errors.add(options[:pkey], _('private key does not match certificate.'))
     end
   end