russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

Summary SshBlockCipher implementations AES-CBC, AES-CTR, 3DES-CBC, etc. report needsmac == true, meaning they are documented/intended to always be paired with a separate integrity MAC. However, key-exchange negotiation only checks needsmac inside the fallback branch of MAC algorithm selection use...