Fix regression in writing authorized principals

[peterverraedt]

Commit ac6d38e introduced a regression in writing of the authorized_principals file, resulting in an empty file.

The function regeneratePrincipalsKeys in
services/asymkey/ssh_key_authorized_principals.go calls the function WriteAuthorizedStringForValidKey for a PublicKey of type KeyTypePrincipal, and ssh.ParseAuthorizedKey would always fail.

This commit adds additional logic to this function to restore the previous behaviour when writing the principals file.

Fixes: #36212

[wxiaoguang]

The ParseAuthorizedKey was used to validate a key to make sure there is no malicious code (for example: \n in the content will break the SSH key files)

Actually we don't really need to use ParseAuthorizedKey , we can use a general regexp to validate the SSH key principal keys.

[peterverraedt]

Gitea is using sshd_config's AuthorizedPrincipalsFile option:

Specifies a file that lists principal names that are accepted for certificate authentication. When using certificates signed by a key listed in TrustedUserCAKeys, this file lists names, one of which must appear in the
certificate for it to be accepted for authentication. Names are listed one per line preceded by key options (as described in AUTHORIZED_KEYS FILE FORMAT in sshd(8)). Empty lines and comments starting with ‘#’ are
ignored.

Specification of the accepted cert-authority is in the TrustedUserCAKeys file.

The man pages are not really clear on which principals are accepted. Clearly no newlines could be present inside an allowed principal, but I'm not sure about spaces etc.

[wxiaoguang]

Hmm ... I remembered wrong (I am not really a authorized_principals user).

Can we have a regexp to validate the key.Content value before putting it into the authorized_principals file?

I can help to add more tests to cover the expected behaviors.

[peterverraedt]

Added a dummy regular expression. I'll try to find any references in sshd code to see what should be the actual expression.

[wxiaoguang]

Thank you very much, and I added some tests.