Potential fix for code scanning alert no. 2388: Use of insecure HostKeyCallback implementation

[eriknordmark]

Potential fix for https://github.com/lf-edge/eve/security/code-scanning/2388

Use a validating host key callback instead of ssh.InsecureIgnoreHostKey(). The best minimal, functionality-preserving fix here is to verify against the user’s known_hosts file using knownhosts.New(...) from golang.org/x/crypto/ssh/knownhosts. This keeps behavior aligned with standard SSH trust-on-first-use / pinned-known-host workflows and avoids introducing custom key parsing logic.

In evetest/ssh.go, inside runScriptOverSSH, replace insecure callback initialization with:

1. Build known_hosts path (e.g., /root/.ssh/known_hosts for current environment consistency).
2. Create callback via knownhosts.New(...).
3. Return a clear error if callback cannot be initialized.
4. Set HostKeyCallback to that callback in ssh.ClientConfig.

Also add the required import for golang.org/x/crypto/ssh/knownhosts.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[milan-zededa]

This is a test framework and we do not care about security between a test and an ephemeral test EVE VM. We should just dismiss this alert.