Fix known_hosts port-aware matching and negation veto semantics

[supermarsx]

Motivation

• Restore OpenSSH-compatible semantics so entries only match the host form appropriate for the connection port and negated patterns veto the whole comma-separated field when they match.
• Prevent overbroad trust decisions where a bare hostname or a non-matching negation could cause acceptance for the wrong port or an excluded host.

Description

• Change exact-index lookup in KnownHosts::verify to use format_host(host, port) so exact plaintext entries match only the port-correct form.
• Update host_matches to evaluate patterns only against the port-aware candidate (via format_host) while preserving the two-pass negation-veto semantics.
• Update verify_hashed to HMAC the port-aware candidate so hashed entries no longer match across ports.
• Add regression tests: bare_host_does_not_match_nonstandard_port, negation_vetoes_nonstandard_port_bracket_pattern, and hashed_bare_host_does_not_match_nonstandard_port to cover the fixed cases.

Testing

• Ran cargo fmt --check, which succeeded.
• Ran cargo test -p spt-trust known_hosts::tests, and the known_hosts unit suite passed (all included tests succeeded).
• Ran cargo test -p spt-trust where the known_hosts tests passed but the full crate test run was interrupted due to environment-dependent CRL/network tests stalling; those unrelated tests did not affect the known_hosts regression coverage.

---

Codex Task