ssh/test: skip KEX test if unsupported by system SSH client

Skip the key exchange test when using the system's ssh CLI if the
required KEX algorithm (e.g., mlkem768x25519-sha256) is not supported.
This is determined by running ssh -Q kex and checking for the presence
of the target algorithm.
Prevents false test failures in CI environments with older or limited
SSH implementations.

Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-darwin-amd64-longtest,x_crypto-gotip-linux-amd64-longtest,x_crypto-gotip-windows-amd64-longtest
Change-Id: I3fac703ec70559e18b30d5fff88274335a7c3952
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/679195
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>

ssh/test/sshcli_test.go

diff --git a/ssh/test/sshcli_test.go b/ssh/test/sshcli_test.go
index 6648067..767dd6c 100644
--- a/ssh/test/sshcli_test.go
+++ b/ssh/test/sshcli_test.go
@@ -119,6 +119,14 @@
 	keyExchanges := append(ssh.SupportedAlgorithms().KeyExchanges, ssh.InsecureAlgorithms().KeyExchanges...)
 	for _, kex := range keyExchanges {
 		t.Run(kex, func(t *testing.T) {
+			cmd := testenv.Command(t, sshCLI, "-Q", "kex")
+			out, err := cmd.CombinedOutput()
+			if err != nil {
+				t.Fatalf("%s failed to check if the KEX is supported, error: %v, command output %q", kex, err, string(out))
+			}
+			if !bytes.Contains(out, []byte(kex)) {
+				t.Skipf("KEX %q is not supported in the installed ssh CLI", kex)
+			}
 			config := &ssh.ServerConfig{
 				Config: ssh.Config{
 					KeyExchanges: []string{kex},
@@ -144,9 +152,9 @@
 				t.Fatalf("unable to get server port: %v", err)
 			}
 
-			cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
+			cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
 				"-o", fmt.Sprintf("KexAlgorithms=%s", kex), "-p", port, "testpubkey@127.0.0.1", "true")
-			out, err := cmd.CombinedOutput()
+			out, err = cmd.CombinedOutput()
 			if err != nil {
 				t.Fatalf("%s failed, error: %v, command output %q", kex, err, string(out))
 			}