Support all accumulating SSH config options instead of re-implementing override behavior

Currently we manually handle SSH config merging, but this requires re-implementing SSH's "first match wins" override behavior ourselves.

## Proposed approach

Instead of manual merging, let the SSH client handle it natively:
- Place `override` configs first in the file (SSH uses "first match wins")
- Keys without values (for non-accumulating options) can be used to remove the entry if we still want to maintain that behavior
- For accumulating options, pass entries as-is from both configs without combining them

This keeps files leaner while avoiding custom override logic.

## Accumulating SSH options to support

These options accumulate across multiple declarations rather than following "first match wins":

| Option | Behavior |
|--------|----------|
| `IdentityFile` | Tried in sequence |
| `CertificateFile` | Tried in sequence |
| `SetEnv` | All values sent to server |
| `SendEnv` | Accumulates (prefix with `-` to clear) |
| `LocalForward` | Multiple tunnels |
| `RemoteForward` | Multiple tunnels |
| `DynamicForward` | Multiple SOCKS proxies |

Additionally, these use space-separated values: `GlobalKnownHostsFile`, `UserKnownHostsFile`, `PermitRemoteOpen`, `CanonicalDomains`.

## Reference

[OpenBSD ssh_config(5)](https://man.openbsd.org/ssh_config.5)

Start by locating the current SSH config merging implementation and its tests, then compare its behavior with the referenced OpenBSD ssh_config(5) documentation. Trace how override and accumulating options are represented, and verify that the listed options are passed in the correct order without manual combination. Done means supported accumulating and space-separated options follow native SSH behavior while existing removal behavior remains intact.

由索引模型根据 Issue 内容生成。