GHSA-3m6q-h5gj-7mrw Gitea has insecure default SSH settings

• Go code.gitea.io/gitea: < 1.25.0 → fixed in 1.25.0

Summary The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box. Details Running `ssh-audit` against a default deployment flags the following as `fail`: • Key exchange • `ecdh-sha2-nistp256` • `ecdh-sha2-nistp384` • `ecdh-sha2-nistp521` • MAC • `hmac-sha1` • Host key • `ssh-rsa` Reproduction ```sh docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local ``` Impact Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several `GITEA__server__SSH_SERVER_*` variables, which most users will never do. Workaround ```ini [server] SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256 SSH_SERVER_CIPHERS = [email protected], aes128-ctr, aes192-ctr, aes256-ctr, [email protected], [email protected] SSH_SERVER_MACS = [email protected], hmac-sha2-256 ``` There is no exposed option to restrict host key algorithms, so `ssh-rsa` remains advertised. Acceptance criteria • [ ] Default `SSH_SERVER_KEY_EXCHANGES`, `SSH_SERVER_CIPHERS`, and `SSH_SERVER_MACS` updated to the secure list above. • [ ] New `SSH_SERVER_HOST_KEY_ALGORITHMS` option added, with a default that excludes `ssh-rsa`. • [ ] Documentation updated to reflect the new defaults. • [ ] `ssh-audit` against a fresh install reports no `[fail]` entries.