fix: what bandit and the remaining lint rules found

- Long docstring and command lines are wrapped; recorded device output in
  tests/ keeps its lines (E501 is off there).
- host_firewall: the negation token is the named constant _NEGATION. bandit
  read token == "!" as a hardcoded password.
- ssh_host_keys: _known_hosts_file takes the expected key as an argument
  instead of asserting it; both callers had already returned when it is None.
- ssh_server: the staged path is on the device, not a local temp file
  (nosec B108).
- tests: raise ... from exc, zip(strict=True).

tests/test_ssh_host_keys.py

@@ -252,7 +252,7 @@ class TestNetmiko:
                         other = paramiko.ECDSAKey.generate()
                         raise paramiko.BadHostKeyException("10.0.0.5", host_key, other)
                     except paramiko.SSHException as exc:
-                        raise RuntimeError(f"A paramiko SSHException occurred: {exc}")
+                        raise RuntimeError(f"A paramiko SSHException occurred: {exc}") from exc
                 except RuntimeError as exc:
                     raise ConnectionException(str(exc)) from exc
         assert caught.value.observation.seen == SshHostKey.of(host_key)

tests/test_vm_cpu_types.py

@@ -33,7 +33,10 @@ def _declared(name: str) -> ast.FunctionDef:
 class TestCreateVmTakesACpuType:
     def test_cpu_type_is_an_optional_keyword(self):
         fn = _declared("create_vm_from_cloud_init")
-        kwonly = {arg.arg: default for arg, default in zip(fn.args.kwonlyargs, fn.args.kw_defaults)}
+        kwonly = {
+            arg.arg: default
+            for arg, default in zip(fn.args.kwonlyargs, fn.args.kw_defaults, strict=True)
+        }
         assert "cpu_type" in kwonly
         default = kwonly["cpu_type"]
         assert isinstance(default, ast.Constant) and default.value is None