Port SSH connhelper from github.com/docker/cli/cli/connhelper/ssh

[fenollp]

Fixes #2032

Note: second commit adds a new feature: ssh://.../path/to/socket to change the --addr that gets passed to buildctl. This is not allowed by Docker CLI's implementation so maybe should not be here.
I needed this as I run buildkitd rootless meaning socket is not under /run/buildkit root path. It's not needed per se as a workaround is:

#!/bin/sh -eu

exec $HOME/bin/buildctl --addr unix:///run/user/1000/buildkit/buildkitd.sock "$@"

I'm leaving this second commit in for discussion but I expect you'll want me to remove it.

[AkihiroSuda]

Thanks

[AkihiroSuda]

Note: second commit adds a new feature: ssh://.../path/to/socket to change the --addr that gets passed to buildctl. This is not allowed by Docker CLI's implementation so maybe should not be here.

Can we support this format in Docker CLI too? (For docker.sock, so slightly offtopic in BuildKit repo though)
Cc @thaJeztah

[alexellis]

Quick question as @AkihiroSuda pointed me here.

I have seen that dockerd can be accessed via SSH instead of via a TCP connection, which means not having to configure mTLS.

For buildkit, whenever it's exposed over TCP it needs mTLS because RUN commands can also call the buildkit API. So would this change that, or is it just proxying from SSH to the socket, where the same configuration means RUN steps can access the API?

I'm looking into whether it makes sense to expose buildkit daemons for remote access (mTLS management required) - or dockerd itself (only seems to need SSH key management?)