ssh-keyscan options do not apply to plugin checkout

By default the buildkite agent will do an `ssh-keyscan` at checkout time.

However, plugins are checked out before the buildkite agent does a keyscan.

Example pipeline:
```
steps:
- command: echo hello
plugins:
"ssh://github.com/buildkite-plugins/docker-buildkite-plugin": bash
```

Example output on 3.8:

upload step:
```
> Preparing working directory
cd /var/lib/buildkite-agent/builds/foo/bar
# Host "github.com" already in list of known hosts at "/var/lib/buildkite-agent/.ssh/known_hosts"
```

next step:
```
> Setting up plugins

Plugin "github.com/buildkite-plugins/docker-buildkite-plugin" will be checked out to "/var/lib/buildkite-agent/plugins/github-com-buildkite-plugins-docker-buildkite-plugin"
The authenticity of host 'github.com (52.74.223.119)' can't be established.
# snip
Are you sure you want to continue connecting (yes/no)? # Received cancellation signal
```

Note this will only happen on "fresh agents" as buildkite checkout will write to `/var/lib/buildkite-agent/.ssh/known_hosts`