ws: be more explicit when handling hostnames on cli

`cockpit-ws` has never protected hostnames from being interpreted as cli
options when passing them to the auth commands (`cockpit-session`,
`cockpit-ssh`, `cockpit.beiboot`).  There have been a couple of relevant
changes over the years:

  - our move to using cockpit-session via unix socket has removed
    exposure to this problem for `cockpit-session`

  - our move from `cockpit-ssh` (glib argument parser) to
    `cockpit.beiboot` (Python argparse) has unfortunately exposed us to
    https://github.com/python/cpython/issues/66623 which means (due to a
    strange heuristic) that arguments starting with '-' can be
    interpreted as positionals if they also have spaces in them

This gives a way to get a hostname starting with a `-` to ssh (where it
*will* be interpreted as an option) and the following argument (the
python invocation on the remote) will be interpreted as the hostname.
Fortunately, new versions of ssh will reject this hostname.  In any
case, we should firm up the code here and add `--` to ensure that it's
definitely interpreted as a hostname by ssh.

For a similar reason add a `--` to the ssh command in `cockpit-ws`.

CVE-2026-4631

src/cockpit/beiboot.py

@@ -250,9 +250,9 @@ def via_ssh(cmd: Sequence[str], dest: str, ssh_askpass: Path, *ssh_opts: str) ->
         # strip off [] IPv6 brackets
         if host.startswith('[') and host.endswith(']'):
             host = host[1:-1]
-        destination = ['-p', port, host]
+        destination = ['-p', port, '--', host]
     else:
-        destination = [dest]
+        destination = ['--', dest]
 
     return (
         'ssh', *ssh_opts, *destination, shlex.join(cmd)

src/ws/cockpitauth.c

@@ -36,7 +36,7 @@
 
 /* we only support beibooting machines with a known/vetted OS, as it's impossible to guarantee
  * forward compatibility for all pages */
-const gchar *cockpit_ws_ssh_program = "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported";
+const gchar *cockpit_ws_ssh_program = "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported --";
 
 /* Some tunables that can be set from tests */
 const gchar *cockpit_ws_session_program = NULL;

vendor/ferny

@@ -1 +1 @@
-Subproject commit c8713c4d3ba74a9d8db1ce8e0a15296e6a333257
+Subproject commit 73dd163349bf048d3d0a36f43228a9d052104e30