feat: expose SSH_MSG_USERAUTH_BANNER messages via Connection.getBanners()

[pdecat]

Summary

Today SSH_MSG_USERAUTH_BANNER messages are read by
AuthenticationManager but stored in a package-private field
(String banner) that no caller outside the library can reach. That
makes it impossible to surface banners to users — most painfully when
the server is a Tailscale-managed sshd
that delivers a web-login URL in a banner and then waits for the user
to finish the web login before sending USERAUTH_SUCCESS. The
authenticateWithNone() call blocks the whole time and the user has
no way to see the URL they need to visit.

This change mirrors the upstream trilead-ssh2 patch in
jenkinsci/trilead-ssh2#206:

• AuthenticationManager: store banners in a List<String> so
  multiple banners aren't clobbered, and expose a public
  getBanners() that returns a defensive snapshot.
• Connection: add a public getBanners() that delegates to the
  auth manager, returning an empty list when authentication hasn't
  been attempted yet.

Threading

Neither accessor synchronizes on the Connection or
AuthenticationManager monitor. The blocking authenticateWith*
entry points already hold the Connection monitor for the full
duration of the auth call, so a caller that wants to surface banners
live — Tailscale's URL arrives in a banner before USERAUTH_SUCCESS
— must be able to read them from another thread while the auth call
is still in flight. Synchronization is scoped to the banners list
itself: the auth thread holds the list monitor while appending; the
accessor holds it briefly while copying out a snapshot.

Why now

ConnectBot has issue #1150
open for the Tailscale-banner case. In
connectbot#2211
the workaround uses reflection on the package-private am/banner
fields. Once this API ships in a sshlib release, that reflection block
can be replaced with connection.getBanners().

I've tested this exact change end-to-end against a Tailscale-managed
sshd by publishing this branch as 2.2.47-SNAPSHOT to mavenLocal,
pointing a connectbot debug build at it, and swapping the reflection
block for a polling loop over connection.banners: the
https://login.tailscale.com/a/... URL now appears in the terminal
during the auth wait and is also picked up by URL Scan. (See screenshot
on the linked ConnectBot PR.)

Compatibility

• No source- or binary-breaking changes: the package-private
  String banner field is replaced with a package-private
  List<String> banners. That field was never part of the public API.
• New public methods only, no removals.

Test plan

• Added ConnectionTest#testGetBannersReturnsEmptyBeforeAuthentication
  verifying getBanners() returns a non-null, empty list when
  am hasn't been instantiated yet.
• ./gradlew compileJava passes (pre-existing AccessController
  deprecation warning only, unrelated).
• ./gradlew test --tests "com.trilead.ssh2.ConnectionTest" passes.
• ./gradlew spotlessCheck passes.
• End-to-end Tailscale test from a connectbot debug build pinned
  to a local SNAPSHOT of this branch (see Why now).

[CLAassistant]

All committers have signed the CLA.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud