new: add pkh put, a native dput replacement for PPA uploads

Upload built source packages over SFTP with host-key verification
(Launchpad fingerprints pinned in host_keys.yml, ask-to-accept
otherwise), Launchpad account discovery (git config lp.user), and
pre-flight checks the upload queue itself never does: changes file
discovery/validation, PPA existence via the Launchpad API, target
series validity, and debian/control Section validity (sections
bundled in distro_info.yml). Upload log prevents duplicate uploads
unless --force.

host_keys.yml

@@ -0,0 +1,19 @@
+## SSH host key fingerprints of known upload targets (`pkh put`).
+## Like distro_info.yml, this file exists so that trust anchors are data,
+## quickly updatable in one place, instead of hardcoded in the source.
+##
+## A server presenting a key whose fingerprint is listed for its host is
+## verified without prompting. Fingerprints are the `SHA256:<base64>` values
+## as displayed by ssh-keygen / pkh; an optional key type prefix (e.g.
+## `ssh-rsa`) is tolerated as the first word of an entry.
+##
+## Source of the Launchpad fingerprints (published "as a stopgap measure
+## until we have signed DNS records"):
+##   https://ubuntu.com/docs/launchpad/user/reference/ssh-fingerprints/
+##   (formerly https://help.launchpad.net/SSHFingerprints)
+
+fingerprints:
+  ppa.launchpad.net:
+    - ssh-rsa SHA256:MGq+4hxD7RduVTcfwlwwboZnsgJC6SL/NltM8ye+gNg
+  upload.ubuntu.com:
+    - ssh-rsa SHA256:FN8sNU/MMmyvw/xtY5sAzkLGmkVQt2QpGZcwsHoBzjc