…ry-pick #17878) (#17960)

Cherry-picked fix: stop extending API key access if OIDC refresh is
available (#17878)

fixes #17070

Cleans up our handling of APIKey expiration and OIDC to keep them
separate concepts. For an OIDC-login APIKey, both the APIKey and OIDC
link must be valid to login. If the OIDC link is expired and we have a
refresh token, we will attempt to refresh.

OIDC refreshes do not have any effect on APIKey expiry.

#17070 (comment)
explains why this is the correct behavior.

Co-authored-by: Spike Curtis <spike@coder.com>

…sh` (cherry-pick #18093) (#18096)

Co-authored-by: Ethan <39577870+ethanndickson@users.noreply.github.com>
Closes #18088.

Co-authored-by: Atif Ali <atif@coder.com>

Co-authored-by: ケイラ <mckayla@hey.com>

…ick #18673) (#18678)

Cherry-picked fix: stop tearing down non-TTY processes on SSH session
end (#18673)

(possibly temporary) fix for #18519

Matches OpenSSH for non-tty sessions, where we don't actively terminate
the process.

Adds explicit tracking to the SSH server for these processes so that if
we are shutting down we terminate them: this ensures that we can shut
down quickly to allow shutdown scripts to run. It also ensures our tests
don't leak system resources.

Co-authored-by: Spike Curtis <spike@coder.com>