Pass existing Net_SFTP object into Net_SFTP_Stream.

Otherwise a new SFTP connection is created by the Stream Wrapper (with no public host key verification).

Follows #9718
Needs backport to stable7
stable6 is not affected (not using SFTP Stream Wrapper)
Ref https://github.com/phpseclib/phpseclib/blob/0.3.6/phpseclib/Net/SFTP/Stream.php#L173

@PVince81 @LukasReschke @icewind1991 @blizzz 
> How global is $GLOBALS ?

http://php.net/manual/en/reserved.variables.globals.php

> Is it kept between PHP requests ?

No. There is basically no such thing. PHP is designed to be stateless (with a few exceptions such as persistent sockets or so).

> Didn't we just want to restrict it to a single PHP request ? (maybe as static class attribute)
> I thought the issue was that it was recreating the stream multiple times inside a single PHP request.

This patch addresses the recreation of Net_SFTP by Net_SFTP_Stream which is a security issue due to lack of public key check. The issue with recreation of OC\Files\Storage\SFTP (which results in recreation of Net_SFTP) still needs to be investigated and is basically a separate issue (a performance issue maybe, not a security issue).