Critical bug in paramiko.SSHConfig()

Hi.
I wanted to bring this issue to your attention as I guess it impacts paramiko and all other packages which rely on paramiko.SSHConfig() specially for implementing SSH Proxycommand.
In a nutshell the problem is the following as follows. Consider a SSH config file stored as "ssh_testConfig" with the following content:

`

Host *  !myJumpHost.myCompany.com
    StrictHostKeyChecking no
    KexAlgorithms +diffie-hellman-group1-sha1
    KexAlgorithms +diffie-hellman-group-exchange-sha1
    Ciphers 3des-cbc,aes128-ctr
    IdentityFile /home/myUser/.ssh/id_rsa
    HostKeyAlgorithms +ssh-dss
    ProxyCommand ssh -F /tmp/tmpw0r7a50q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W %h:%p -q %r@myJumpHost.myCompany.com


Host myJumpHost.myCompany.com
    StrictHostKeyChecking no
    KexAlgorithms +diffie-hellman-group1-sha1
    KexAlgorithms +diffie-hellman-group-exchange-sha1
    Ciphers 3des-cbc,aes128-ctr
    IdentityFile /home/myUser/.ssh/id_rsa
    HostKeyAlgorithms +ssh-dss
`

When you use this config file in conjunction with a paramiko SSHClient which uses this SSH config file with the username="OtherUser", the expectation is that the proxy command is parsed as the following:
ssh -F /tmp/tmpw0r7a50q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W hostA:22 -q OtherUser@myJumpHost.myCompany.com

However it gets parsed with %r replaced with the user running the Python script:
ssh -F /tmp/tmpw0r7a50q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W hostA:22 -q myUser@myJumpHost.myCompany.com

You can observe that in the following code snippet using that SSH config file:

`
Python 3.6.9 (default, Jan 26 2021, 15:33:00) 
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from paramiko import SSHConfig
>>> my_config = SSHConfig()
>>> my_config.parse(open("ssh_testConfig"))
>>> my_config.lookup('hostA')
{'stricthostkeychecking': 'no', 'kexalgorithms': '+diffie-hellman-group1-sha1', 'ciphers': '3des-cbc,aes128-ctr', 'identityfile': ['/home/myUser/.ssh/id_rsa'], 'hostkeyalgorithms': '+ssh-dss', 'proxycommand': 'ssh -F /tmp/tmpw0r7a50q -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W hostA:22 -q myUser@myJumpHost.myCompany.com', 'hostname': 'hostA'}
>>>
 `

Is there a way to fix this issue? Can that class be modified so that if it is used with SSHClient() it replaces %h, %p and %r from the parameters provided to SSHClient() instead of local shell parameter for the user running the script?
Thanks.

Start at the SSHConfig.parse and lookup entry points and reproduce the behavior with the shown ssh_testConfig; compare it with how SSHClient receives the username. Done means the proxy command's %r uses the username supplied to SSHClient rather than the local shell user, while the demonstrated %h and %p substitutions continue to work.