feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

CHANGELOG.md

@@ -18,6 +18,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Graceful shutdown on SIGINT** — persist `.goget.meta` sidecar on interrupt
   for SFTP single-file downloads, ensuring progress is saved for resume.
 
+**Security**
+
+- **Certificate pinning across all TLS protocols** — `--pinned-cert` now
+  applies to FTPS, Gemini, and WebDAVS in addition to HTTP/HTTPS. The leaf
+  certificate SHA-256 hash is verified via `tls.Config.VerifyPeerCertificate`
+  on every TLS-bearing protocol.
+- **SSH host-key pinning for SFTP** — new `--pinned-host-key` flag pins the
+  SSH host key by its OpenSSH fingerprint (`SHA256:<base64>`, as produced by
+  `ssh-keygen -lf`). Raw lowercase-hex SHA-256 of the key wire format is also
+  accepted. Pinning takes precedence over `--ssh-insecure` and `known_hosts`.
+- **WebDAV TLS config fix** — `webdav.Protocol.getHTTPTransport` now builds
+  its `tls.Config` from the caller-provided `transport.TLSConfig` instead of
+  a fresh config that silently dropped CA certs, mTLS, keylog, and pinned-cert
+  settings.
+
 **Recursive downloading & mirroring**
 
 - `--adjust-extension` extended to non-HTTP protocols — applies `.html`