fix: address CodeQL security alerts

[rmanibus]

Fixes #162

This PR addresses three CodeQL security alerts with minimal changes:

1. go/insecure-hostkeycallback: Replaced insecure SFTP host key validation with a secure default that checks the system known_hosts file.
2. go/allocation-size-overflow: Added a length check in pkg/crypto to prevent potential integer overflows during large buffer allocations.
3. Acknowledged Insecure E2E: Explicitly marked the E2E test SFTP callback as insecure with //nolint:gosec to satisfy security scanners while maintaining test functionality.

[codecov]

Codecov Report

❌ Patch coverage is 76.25000% with 19 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/sftp/sftp.go	53.33%	5 Missing and 2 partials ⚠️
cmd/cloudstic/store.go	50.00%	2 Missing and 2 partials ⚠️
pkg/source/sftp_source.go	78.57%	3 Missing ⚠️
pkg/store/sftp.go	78.57%	3 Missing ⚠️
pkg/crypto/crypto.go	0.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!