fix(security): harden SSH target handling (#4001)

Thanks @YLChen-007.

Co-authored-by: Edward-x <YLChen-007@users.noreply.github.com>

src/infra/ssh-config.ts

@@ -58,7 +58,8 @@ export async function resolveSshConfig(
     args.push("-i", opts.identity.trim());
   }
   const userHost = target.user ? `${target.user}@${target.host}` : target.host;
-  args.push(userHost);
+  // Use "--" so userHost can't be parsed as an ssh option.
+  args.push("--", userHost);
 
   return await new Promise<SshResolvedConfig | null>((resolve) => {
     const child = spawn(sshPath, args, {