How the XZ backdoor almost compromised SSH – and how it was caught just in time