Address CodeQL security alerts: SFTP host key validation and crypto allocation overflow

[rmanibus]

Multiple security alerts were identified by CodeQL:

1. Insecure HostKeyCallback (CWE-322): The SFTP implementation was using ssh.InsecureIgnoreHostKey(), which makes connections vulnerable to Man-in-the-Middle (MitM) attacks.
2. Allocation Size Overflow (CWE-190): The pkg/crypto package lacked a check on plaintext length before buffer allocation, potentially leading to integer overflows or panics with extremely large inputs.

These issues are addressed in PR #161 by implementing a secure default known_hosts check for SFTP and adding a length guard in the crypto package.