fix(negotiation): exclude SHA-1 MACs from Preferred::DEFAULT

HMAC_SHA1 and HMAC_SHA1_ETM were included in the default MAC negotiation
list (HMAC_ORDER). SHA-1 based MACs are deprecated per RFC 8308 and removed
from OpenSSH 8.7+ defaults.

Introduce SAFE_HMAC_ORDER (SHA-512 and SHA-256 variants only) and use it
in Preferred::DEFAULT and Preferred::COMPRESSED. HMAC_ORDER is kept as-is
for users who need to interoperate with legacy servers that support only
SHA-1 MACs — set it explicitly via Preferred { mac: Cow::Borrowed(HMAC_ORDER) }.

The KEX default (SAFE_KEX_ORDER) already excludes SHA-1 correctly; this
aligns MAC defaults to the same standard.

Author: derek-codebridge

russh/src/negotiation.rs

@@ -131,6 +131,14 @@ const CIPHER_ORDER: &[cipher::Name] = &[
     cipher::AES_128_CTR,
 ];
 
+// SHA-1 MAC variants excluded; see HMAC_ORDER for the full list including legacy algorithms.
+const SAFE_HMAC_ORDER: &[mac::Name] = &[
+    mac::HMAC_SHA512_ETM,
+    mac::HMAC_SHA256_ETM,
+    mac::HMAC_SHA512,
+    mac::HMAC_SHA256,
+];
+
 const HMAC_ORDER: &[mac::Name] = &[
     mac::HMAC_SHA512_ETM,
     mac::HMAC_SHA256_ETM,
@@ -171,15 +179,15 @@ impl Preferred {
             Algorithm::Rsa { hash: None },
         ]),
         cipher: Cow::Borrowed(CIPHER_ORDER),
-        mac: Cow::Borrowed(HMAC_ORDER),
+        mac: Cow::Borrowed(SAFE_HMAC_ORDER),
         compression: Cow::Borrowed(COMPRESSION_ORDER),
     };
 
     pub const COMPRESSED: Preferred = Preferred {
         kex: Cow::Borrowed(SAFE_KEX_ORDER),
         key: Preferred::DEFAULT.key,
         cipher: Cow::Borrowed(CIPHER_ORDER),
-        mac: Cow::Borrowed(HMAC_ORDER),
+        mac: Cow::Borrowed(SAFE_HMAC_ORDER),
         compression: Cow::Borrowed(COMPRESSION_ORDER),
     };
 }