time package gets ExternalNow for external clocks, x/crypto/ssh source-address fix

The long-running proposal to add ExternalNow and friends to the time package for external clocks and timers is accepted, closing out a discussion that has been running since 2020 and giving projects that plumb their own time sources a sanctioned way to do it. On the security side, x/crypto/ssh gets an advisory covering a source-address critical option that was only enforced on the public-key callback paths, extending the earlier CVE fix to the other auth callbacks. Elsewhere the r/golang crowd is having one of its periodic arguments about whether the language is drifting from its simple roots, and a dev.to piece pushes back with the reminder that Go does not force clean architecture on anyone, that part is still the reader's job.