bump third party libs
refactor remote command logic to use more recent go.crypto/ssh code