Add SSH key fields for lossless encrypted PEM storage and optional passphrase

[OrionCodeDev]

Summary
Extends the server SSH key models and request mapping to persist original encrypted PEM and optional passphrase fields, enabling clients to preserve exact imports and decrypt on-demand for agent use.

Linked PRs needed to work for this changes:

• clients: Lossless SSH key import with optional passphrase storage and on-demand decryption for SSH agent clients#16121
• server: Add SSH key fields for lossless encrypted PEM storage and optional passphrase #6232
• sdk-internal: Preserve original encrypted OpenSSH/PKCS#8 PEM on import + on-demand decryption for SSH agent sdk-internal#408

Linked Issue

• OpenSSH keys with passphrase not saving correctly (OpenSSH keys with passphrase not saving correctly clients#13878)
• SSH agent can't import RSA keys (PKCS#1 / PEM) (SSH agent can't import RSA keys (PKCS#1 / PEM) clients#15088)
• unable to save SSH key with or without a passphrase from puttygen (unable to save SSH key with or without a passphrase from puttygen clients#13343)

Changes

• Core model
  • src/Core/Vault/Models/Data/CipherSSHKeyData.cs
    • Added OriginalPrivateKey, IsEncrypted, SshKeyPassphrase.
• API model
  • src/Api/Vault/Models/CipherSSHKeyModel.cs
    • Added [EncryptedString] OriginalPrivateKey, IsEncrypted, SshKeyPassphrase.
    • Constructor maps from CipherSSHKeyData.
• Request mapping
  • src/Api/Vault/Models/Request/CipherRequestModel.cs
    • ToCipherSSHKeyData() now assigns:
      • OriginalPrivateKey, IsEncrypted, SshKeyPassphrase from request model when provided.

Backwards Compatibility

• Optional fields; no service-level breaking change.
• Existing clients not sending these fields remain supported.

Security Considerations

• All new fields are encrypted strings at rest, consistent with existing cipher data protections.

Testing

• API: Create/Update SSH key cipher including OriginalPrivateKey and SshKeyPassphrase; verify round-trip persistence.
• Ensure existing create/update flows still pass with minimal payloads (backward compatibility).

Release Notes

• Add server support for preserving encrypted SSH private key PEM and optional passphrase on SSH key items.

General Notes

Why this fixes the bug

• Clients now retain the original encrypted PEM that was imported. Copy/export from the item reproduces the exact input (including encryption header), avoiding mismatches with SSH tooling.
• The agent decrypts in memory for use; the vault never stores plaintext.

Rollout

• Order: server → sdk-internal → clients.
• Mixed-version environments remain functional; new fields are optional.

Follow-ups (optional)

• Prompt passphrase on agent use when it isn’t stored, then decrypt transiently and proceed (without saving).
• Consider deriving IsEncrypted on the server from OriginalPrivateKey header, if desired, and removing reliance on client-provided IsEncrypted entirely.
• Expand automated tests for PKCS#8 encrypted flow; add end-to-end agent test.