security: fix CVE-2025-58181

[thatnealpatel]

This is a PRIVATE issue for CVE-2025-58181.
It is tracked in http://b/439834252.

/cc @golang/security and @golang/release

[gopherbot]

Change https://go.dev/cl/721961 mentions this issue: ssh: curb GSSAPI DoS risk by limiting number of specified OIDs