GHA: test WinCNG SCP/SFTP via curl runtests

The WinCNG backend has been missing runtime tests for a while. To
restore some level of testing, this PR make use of curl's regression
test suite (`runtests`) to run SCP/SFTP-specific tests with the
master/PR libssh2 revision at hand. Some tests need to be disabled when
using the built-in Windows OpenSSH server.

The current CI jobs reproduce the long-running WinCNG flaky failure
reported in #804 reliability.

Note, if these CI jobs make libssh2 CI a pain to use, they will be
removed. This has a reasonably fair chance to happen, based on the
experience with curl CI with Windows.

Also:
- test both ECDH and non-ECDH builds.
- test build on x64 and ARM64.
- test with both Windows built-in OpenSSH port and MSYS2's sshd.
- enable debug logging in libssh2 while running the tests.
- for extra stress, run each of the 56-57 tests 6 times.
  This may be lowered in a future commit to avoid flakiness and reduce
  CI load and job times.

Caveats:
- as seen in curl CI, runtests may result in hangs due to broken pipes
  and error 2304 for undiscovered reasons.
  Discussion: https://github.com/curl/curl/discussions/14854
- MSBuild has an undisablable "smart" feature that sometimes marks a
  successful run a failure.
  Refs:
  a477789c43
  https://github.com/curl/curl/pull/18301
- these tests are different in scope than libssh2's own.
- tests sometime fail flaky with:
  ```
  Failure Event: -43 - Failed getting banner
  ```
  Ref: https://github.com/libssh2/libssh2/actions/runs/34134974899/job/101783681252?pr=2590
- running on modern runner machines, the Win10-introduced DH algo is
  always enabled.

Ref: https://github.com/libssh2/libssh2/discussions/2049
Ref: #2583

Closes #2590

.github/workflows/ci.yml

@@ -1312,3 +1312,159 @@ jobs:
           else
             make -C bld examples
           fi
+
+  build_curl:
+    name: 'curl, CM ${{ matrix.arch }}-${{ matrix.plat }} ${{ matrix.name }}'
+    runs-on: '${{ matrix.image }}'
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: msys2 {0}  # zizmor: ignore[misfeature]
+    env:
+      CURL_VERNUM: '8.22.0'
+      CURL_SHA256: f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7
+      OPENSSH_WINDOWS_VERSION: 10.0.0.0p2-Preview
+      OPENSSH_WINDOWS_SHA256_ARM64: 698c6aec31c1dd0fb996206e8741f4531a97355686b5431ef347d531b07fcd42
+      OPENSSH_WINDOWS_SHA256_WIN64: 23f50f3458c4c5d0b12217c6a5ddfde0137210a30fa870e98b29827f7b43aba5
+      MATRIX_ARCH: '${{ matrix.arch }}'
+      MATRIX_CRYPTO: '${{ matrix.crypto }}'
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      MATRIX_OPENSSH: '${{ matrix.openssh }}'
+      MATRIX_TYPE: '${{ matrix.type }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { image: 'windows-2025'  , arch: x64  , plat: windows, type: Debug  , crypto: WinCNG , wincng_ecdsa: 'ON' , log: 'ON' , shared: 'OFF', zlib: 'OFF', unity: 'ON',
+              name: 'WinCNG ECDSA' }
+          - { image: 'windows-11-arm', arch: arm64, plat: windows, type: Debug  , crypto: WinCNG , wincng_ecdsa: 'OFF', log: 'ON' , shared: 'OFF', zlib: 'OFF', unity: 'ON',
+              name: 'WinCNG !ECDSA', openssh: 'OpenSSH-Windows' }
+    steps:
+      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
+        with:
+          msystem: ${{ matrix.arch == 'arm64' && 'clangarm64' || 'ucrt64' }}
+          release: ${{ contains(matrix.image, 'arm') }}
+          cache: ${{ contains(matrix.image, 'arm') }}
+          path-type: inherit
+          install: perl
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        env:
+          MATRIX_PLAT: '${{ matrix.plat }}'
+          MATRIX_WINCND_ECDSA: '${{ matrix.wincng_ecdsa }}'
+          MATRIX_LOG: '${{ matrix.log }}'
+          MATRIX_SHARED: '${{ matrix.shared }}'
+          MATRIX_ZLIB: '${{ matrix.zlib }}'
+          MATRIX_UNITY: '${{ matrix.unity }}'
+        run: |
+          options=''
+          if [ "${MATRIX_CRYPTO}" = 'WinCNG' ]; then
+            options+=" -DENABLE_ECDSA_WINCNG=${MATRIX_WINCND_ECDSA}"
+            cflags+=' -DLIBSSH2_KEX_SHA1_ENABLE -DLIBSSH2_MD5_ENABLE -DLIBSSH2_MD5_PEM_ENABLE -DLIBSSH2_HMAC_SHA1_ENABLE'
+            cflags+=' -DLIBSSH2_RSA_SHA1_ENABLE -DLIBSSH2_BLOWFISH_ENABLE -DLIBSSH2_RC4_ENABLE -DLIBSSH2_3DES_ENABLE'
+            cflags+=' -DLIBSSH2_DSA_ENABLE'
+          fi
+          cmake -B bld ${options} \
+            -DCMAKE_INSTALL_PREFIX="$HOME"/libssh2-install \
+            -DCMAKE_C_FLAGS="${cflags}" \
+            -DCMAKE_GENERATOR_PLATFORM="${MATRIX_ARCH}" \
+            -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
+            -DCMAKE_UNITY_BUILD="${MATRIX_UNITY}" \
+            -DENABLE_WERROR=ON \
+            -DENABLE_DEBUG_LOGGING="${MATRIX_LOG}" \
+            -DBUILD_SHARED_LIBS="${MATRIX_SHARED}" \
+            -DCRYPTO_BACKEND="${MATRIX_CRYPTO}" \
+            -DENABLE_ZLIB_COMPRESSION="${MATRIX_ZLIB}" \
+            -DLIBSSH2_BUILD_DOCS=OFF \
+            -DBUILD_EXAMPLES=OFF \
+            -DBUILD_TESTING=OFF
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'libssh2_config.h'
+        run: |
+          echo '::group::raw'; cat bld/src/libssh2_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/src/libssh2_config.h | sort || true
+
+      - name: 'build'
+        run: cmake --build bld --config "${MATRIX_TYPE}" --parallel 5
+
+      - name: 'install'
+        run: cmake --install bld --config "${MATRIX_TYPE}" --verbose
+
+      - name: 'install curl from source'
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/curl/curl/releases/download/curl-${CURL_VERNUM//./_}/curl-${CURL_VERNUM}.tar.xz" --output pkg.bin
+          sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${CURL_SHA256}" && tar -xJf pkg.bin && rm -f pkg.bin
+          cd "curl-${CURL_VERNUM}"
+          cmake -B bld -DBUILD_SHARED_LIBS=OFF -DCURL_USE_LIBPSL=OFF -DCURL_ENABLE_SSL=OFF -DENABLE_DEBUG=ON \
+            -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF -DCURL_DISABLE_TYPECHECK=ON \
+            -DCMAKE_GENERATOR_PLATFORM="${MATRIX_ARCH}" \
+            -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
+            -DCMAKE_C_FLAGS=-DCURL_LIBSSH2_DEBUG \
+            -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+            -DCURL_DISABLE_DICT=ON -DCURL_DISABLE_FILE=ON -DCURL_DISABLE_FTP=ON -DCURL_DISABLE_GOPHER=ON -DCURL_DISABLE_HTTP=ON -DCURL_DISABLE_IMAP=ON \
+            -DCURL_DISABLE_IPFS=ON -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCURL_DISABLE_MQTT=ON -DCURL_DISABLE_POP3=ON \
+            -DCURL_DISABLE_RTSP=ON -DCURL_DISABLE_SMTP=ON -DCURL_DISABLE_TELNET=ON -DCURL_DISABLE_TFTP=ON -DCURL_DISABLE_WEBSOCKETS=ON \
+            -DLIBSSH2_INCLUDE_DIR="$(cygpath --mixed "$HOME"/libssh2-install/include)" \
+            -DLIBSSH2_LIBRARY="$(cygpath --mixed "$HOME"/libssh2-install/lib/libssh2.lib)"
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+          cmake --build bld --config Debug --parallel 5
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 file --
+          /usr/bin/find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --
+          PATH="$PWD/bld/lib/Debug:$PATH"
+          bld/src/Debug/curl.exe --disable --version
+          cmake --build bld --config Debug --parallel 5 --target testdeps
+
+      - name: 'install test prereqs'
+        timeout-minutes: 2
+        run: |
+          if [ -z "${MATRIX_OPENSSH}" ]; then  # MSYS2 openssh
+            /usr/bin/pacman --noconfirm --noprogressbar --sync --needed openssh
+          elif [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows-builtin' ]; then
+            # https://learn.microsoft.com/windows-server/administration/openssh/openssh_install_firstuse
+            if [[ "${MATRIX_IMAGE}" = *'windows-2025'* ]]; then
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0'
+              pwsh -Command 'Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0'
+            fi
+          else  # OpenSSH-Windows
+            cd /c  # no D: drive on windows-11-arm runners
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-ARM64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_ARM64}" && unzip pkg.bin && rm -f pkg.bin
+            else
+              curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+                --location --proto-redir =https "https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_WINDOWS_VERSION}/OpenSSH-Win64.zip" --output pkg.bin
+              sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OPENSSH_WINDOWS_SHA256_WIN64}" && unzip pkg.bin && rm -f pkg.bin
+            fi
+          fi
+
+      - name: 'run tests'
+        timeout-minutes: 6
+        run: |
+          cd "curl-${CURL_VERNUM}"
+          export TFLAGS='-j8 SCP SFTP --retry=0 --repeat=6'
+          if [[ "${MATRIX_CRYPTO}" = *'WinCNG'* ]]; then
+            export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256
+          fi
+          if [ -n "${MATRIX_OPENSSH}" ]; then  # OpenSSH-Windows
+            TFLAGS+=' ~601 ~603 ~617 ~619 ~621 ~641 ~665 ~2004'  # SCP
+            TFLAGS+=' ~3022'  # 'SCP correct sha256 host key' SCP, server sha256 key check
+          fi
+          if [ "${MATRIX_OPENSSH}" = 'OpenSSH-Windows' ]; then
+            if [[ "${MATRIX_IMAGE}" = *'-arm'* ]]; then
+              PATH="/c/OpenSSH-ARM64:$PATH"
+            else
+              PATH="/c/OpenSSH-Win64:$PATH"
+            fi
+          fi
+          PATH="$PWD/bld/lib/Debug:$PATH:/c/my-stunnel/bin"
+          cmake --build bld --config Debug --target test-ci