Support Paramiko 5 in SSH and SFTP providers

[shivaam]

Follow-up to #69669.

What

This removes the temporary paramiko<5.0.0 cap from the SSH and SFTP providers and updates the generated dependency tables/lockfile so the providers can resolve Paramiko 5.

It also keeps RSA private-key validation working with Paramiko 5 by validating RSA keys with rsa-sha2-512 instead of Paramiko's removed legacy ssh-rsa SHA-1 signing path.

Why

Paramiko 5 removed legacy SHA-1 SSH behavior, including RSA SHA-1 ssh-rsa signing. Airflow's SSH hook private-key loader was using key.sign_ssh_data(b"") as a validation probe, which makes RSA keys fail under Paramiko 5 with KeyError: 'ssh-rsa'.

RSA keys are still supported; the issue is only the old SHA-1 ssh-rsa algorithm. The changelog notes call this out for users whose servers only support legacy SHA-1 SSH algorithms.

Validation

• uv run python -c 'import inspect, paramiko; print(paramiko.__version__); print(inspect.signature(paramiko.SSHClient.connect)); print(paramiko.RSAKey.HASHES.keys())'
• uv lock --check
• git diff --check
• uv run pytest providers/ssh/tests/unit/ssh/hooks/test_ssh.py -k 'private_key or host_key or dss_host_key or unsupported_host_key' -q
• uv run pytest providers/ssh/tests/unit/ssh/hooks/test_ssh_async.py providers/sftp/tests/unit/sftp/hooks/test_sftp.py -k 'host_key or private_key or connection' -q
• uv run ruff format --check providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
• uv run ruff check providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
• uv run mypy --config-file pyproject.toml providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
• uv run prek --files providers/ssh/src/airflow/providers/ssh/hooks/ssh.py providers/ssh/pyproject.toml providers/ssh/README.rst providers/ssh/docs/index.rst providers/ssh/docs/changelog.rst providers/sftp/pyproject.toml providers/sftp/README.rst providers/sftp/docs/index.rst providers/sftp/docs/changelog.rst uv.lock

Local caveat: uv run prek mypy-providers --files providers/ssh/src/airflow/providers/ssh/hooks/ssh.py exits 137 during the local Breeze provider mypy environment setup, without emitting a mypy type error. The direct mypy command above passes.

[eladkal]

Correct me if I am wrong but from 4->5 this is not a breaking change in terms of Airflow operators right?

[shivaam]

Correct me if I am wrong but from 4->5 this is not a breaking change in terms of Airflow operators right?

It will be breaking for users using sha-1 ssh algorithms.