[16.0-stable] zedUpload/sftp: accept a scheme-qualified host as well as bare host:port - #92

getSftpClient assumed host was always a bare "host:port" and extracted the
hostname for its pre-flight DNS check via a naive strings.Split(host, ":"),
taking the first element. Since lf-edge/eve#5588,
EVE's datastore Fqdn is always scheme-qualified for every datastore type,
including SFTP (e.g. "sftp://host:port"), which broke that assumption: the
first element became the literal scheme "sftp" instead of the real host,
causing the SFTP download to fail with:

sftpclient failed for sftp://244.244.244.244:22: lookup sftp on 127.0.0.1:53: no such host

(i.e. trying to resolve "sftp")

Detect which form was given via url.Parse: a real scheme-qualified
authority-form URL parses with a non-empty Host, whereas a bare host:port
also "succeeds" but only as an opaque URI (empty Host, with the part
before the port's colon landing in Scheme/Opaque instead). Use u.Host when
present, and fall back to the original bare host:port otherwise, so
existing callers outside EVE are unaffected.

Also replaces the naive colon-split used for the hostname-only DNS
pre-check with net.SplitHostPort, which additionally fixes handling of a
bracketed IPv6 literal (e.g. "[::1]:22") in both forms.

Signed-off-by: Milan Lenco <milan@zededa.com>
(cherry picked from commit 882c841)

Let's Encrypt rotated badssl.com's wrong-host certificate onto a new
intermediate (YR2) on 2026-07-28, breaking the hardcoded R\d{1,2}
regex. Match only the stable, non-rotating parts of the issuer DN
instead, matching the fix from main (commit 6b30666, "nettrace: don't
pin Let's Encrypt intermediate"), adapted to this branch's older,
non-subtest test structure.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Milan Lenco <milan@zededa.com>