x/crypto/ssh only supports aes256-ctr/cbc for private key encryption,
so keys exported from 1Password (aes256-gcm) could not be decrypted even
with the correct passphrase. Decrypt the openssh-key-v1 blob ourselves
(bcrypt_pbkdf ported from x/crypto's internal package, AES-256-GCM via
stdlib, auth tag stored as raw bytes after the encrypted block) and
re-marshal it as an unencrypted key for ssh.ParsePrivateKey.
