Replace MD5 fingerprint format with SHA-256 Base64 encoding to match OpenSSH 6.8+ behavior. Existing stored keys automatically use the new format without migration.

Description

Updates SSH host key fingerprints to use SHA-256 with Base64 encoding instead of the deprecated MD5 hex format, aligning with OpenSSH 6.8+ standards.

Old format: B5:A8:8D:C1:11:E5:C5:E0:53:62:DD:20:E1:DA:85
New format: SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8

Changes Made

• Modified HostKey.getFingerprint() to use SHA-256 MessageDigest with Base64 encoding
• Added imports for MessageDigest, NoSuchAlgorithmException, and Base64
• Added fallback to MD5 if SHA-256 is unavailable (defensive programming)
• Created HostKeyTest to verify the new fingerprint format

Backward Compatibility

Fully backward compatible - no data migration required:

• Existing keys stored as raw bytes in XML continue to work unchanged
• Fingerprints calculated on-demand from raw bytes, not stored
• Key verification uses byte comparison, not fingerprint strings
• All UI messages automatically display new format

Testing done

• All existing tests pass (mvn clean test)
• Created new HostKeyTest with two test cases:
  • testFingerprintUsesSHA256() - Verifies SHA256: prefix and valid Base64 encoding
  • testFingerprintFormat() - Validates the complete format matches SHA256:[Base64] pattern
• Code formatted with Spotless (mvn spotless:apply)
• Full build successful (mvn clean install)
• Verified that HostKeyHelper stores raw key bytes, ensuring automatic migration
• Reviewed all verification strategy implementations to confirm they use raw byte comparison

Manual Testing:
The change affects fingerprint display in:

• Console log messages (e.g., "Key auto-trusted" messages)
• Trust key UI dialog when manually approving keys
• Both locations now show SHA256 format instead of MD5

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

Related Issues

Fixes JENKINS-76219 - Please update to using SHA-256 for SSH key fingerprints

Additional Notes

This change only affects the display format of fingerprints. The underlying storage and verification mechanisms are unchanged, ensuring seamless operation with existing configurations. Users will see the new SHA-256 format immediately without any action required on their part.