impossible to enable older lower ssh ciphers in ansible

##### SUMMARY

##### ISSUE TYPE
- Bug Report

##### PYLISSH and LIBSSH VERSION

```paste below
Requirement already satisfied: ansible-pylibssh in /usr/local/lib/python3.12/site-packages (1.4.0)
```

##### OS / ENVIRONMENT

ansible running in docker

ansible [core 2.21.0]
config file = /play/ansible_test.cfg
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/lib/python3.12/site-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible
python version = 3.12.13 (main, May 19 2026, 23:48:44) [GCC 14.2.0] (/usr/local/bin/python3.12)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)

##### STEPS TO REPRODUCE

Ansible needs to connect ssh to old cisco equipment (aes128-cbc hmac-sha1)
but no matter what parameters i give, it always refuses with "invalid kex"

```paste below
ansible_connection : ansible.netcommon.network_cli
ansible_network_cli_ssh_type: libssh
# ansible_ssh_common_args: '-o Ciphers=+aes128-cbc,3des-cbc -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o MACs=+hmac-sha1,hmac-sha1-96'
# ansible_ssh_extra_args: '-o Ciphers=+aes128-cbc,3des-cbc -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o MACs=+hmac-sha1,hmac-sha1-96'

ansible_network_os: cisco.ios.ios

ansible_network_cli_libssh_macs: "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96"
ansible_network_cli_libssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes128-cbc,aes256-cbc,3des-cbc"
ansible_network_cli_libssh_key_exchange_algorithms: "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1"

ansible_libssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes128-cbc,aes256-cbc,3des-cbc"
ansible_libssh_key_exchange_algorithms: "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1"
ansible_libssh_macs: "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96"

```

##### EXPECTED RESULTS

##### ACTUAL RESULTS

ssh type is set to libssh
Loading collection ansible.builtin from
local domain socket path is /root/.ansible/pc/60883546de
redirecting (type: action) ansible.builtin.ios to cisco.ios.ios
ANSIBLE_NETWORK_IMPORT_MODULES: enabled
redirecting (type: modules) ansible.builtin.ios_facts to cisco.ios.ios_facts
ANSIBLE_NETWORK_IMPORT_MODULES: found ios_facts at /usr/local/lib/python3.12/site-packages/ansible_collections/cisco/ios/plugins/modules/ios_facts.py
ANSIBLE_NETWORK_IMPORT_MODULES: running ios_facts
ANSIBLE_NETWORK_IMPORT_MODULES: _load_params skipped for action plugin in direct execution
ANSIBLE_NETWORK_IMPORT_MODULES: complete
ANSIBLE_NETWORK_IMPORT_MODULES: Result: {'failed': True, 'msg': 'ssh connection failed: ssh connect failed: kex error : no match for method mac algo client->server: server [hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96], client [hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512]'}
[ERROR]: Task failed: Action failed: ssh connection failed: ssh connect failed: kex error : no match for method mac algo client->server: server [hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96], client [hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512]
Origin: /play/gn-ansible-discovery/get-int-state-test.yml:101:5

99
100
101 - name: Gather IOS facts of device
^ column 5

```paste below

```

Start by reproducing the ios_facts connection with the supplied libssh cipher, key-exchange, and MAC variables, focusing on the reported client/server MAC mismatch. Trace how these settings reach the libssh connection and consider the issue complete when the configured legacy MACs are accepted and the Cisco IOS connection succeeds.

Written by the indexing model from the issue text.