perf(filter): match SSH connection state via &'static str, drop Debug allocs

[obchain]

Summary

matches_application_filter was deriving the matchable SSH connection-state string by Debug-formatting SshConnectionState and lowercasing the result — two heap allocations per SSH connection per filter criterion per render frame:

let state_str = format!("{:?}", info.connection_state).to_lowercase();

SshConnectionState is a fieldless 4-variant enum, so its canonical lower-case form is a &'static str known at compile time. Replace the runtime derivation with an exhaustive match — the compiler now enforces sync with the enum, so future variants can't silently drift out of filter coverage.

Beyond the alloc savings this also fixes a small abstraction smell: Debug output is for diagnostics, not a stable user-facing string, and shouldn't be the source of truth for a filter token.

Closes #336.

Behavior

No change. The match arms return the same lower-case strings (banner, keyexchange, authentication, established) that format!("{:?}", …).to_lowercase() produced. A new unit test asserts each variant's canonical token matches the right filter and doesn't bleed across variants.

Verification

cargo fmt --check       # clean
cargo clippy --all-targets -- -D warnings  # clean
cargo test --lib        # 372 passed; 0 failed (incl. new test_ssh_connection_state_filter_matches_each_variant)

Test plan

• Unit test covers each SshConnectionState variant
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• Full cargo test --lib