fix: address high-severity security issues from review

- Use subtle.ConstantTimeCompare for static credential checks to
  prevent timing side-channel attacks
- Cap failCounts (100k) and rememberedCreds (10k) maps with eviction
  to prevent memory exhaustion from botnet-scale scanning
- Sweep expired credentials on each auth attempt
- Add configurable max_connections (default 500) with semaphore to
  limit concurrent connections and prevent goroutine/fd exhaustion

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

oubliette.toml.example

@@ -3,6 +3,7 @@ log_level = "info"
 [ssh]
 listen_addr = ":2222"
 host_key_path = "oubliette_host_key"
+max_connections = 500
 
 [auth]
 accept_after = 10