CVE-2026-39830: discard unsolicited global and channel request responses
instead of blocking the connection's read loop, and drain stale responses
before sending a request, in the golang.org/x/crypto/ssh copies vendored by
podman and by the bundled gvisor-tap-vsock (gvproxy)