fix: resolve default known hosts for strict SSH

[hshimomura]

Problem

Strict SSH host-key verification is enabled by default, but go-netconf does not
configure a known_hosts source for scrapligo. As a result, secure connections
fail while building the SSH transport with:

errBadOption: strict host key checking requested, but no known hosts file

Change

When InsecureSkipVerify is false, add scrapligo's
WithSSHKnownHostsFileSystem() option. Scrapligo then resolves the standard
files in this order:

1. ~/.ssh/known_hosts
2. /etc/ssh/ssh_known_hosts
3. fail if neither file is available

The explicit insecure path remains unchanged and continues to use
WithAuthNoStrictKey().

Security behavior

This does not introduce trust-on-first-use or weaken verification. Strict mode
still requires a matching entry in a standard known_hosts file, and fails
closed when no usable file or matching host key is present.

Validation

• go test -race ./...
• strict mode resolves a job-specific ~/.ssh/known_hosts
• explicit insecure mode skips known_hosts lookup
• git diff --check

As a downstream integration check, terraform-provider-iosxe v1.0.0 built
against this change completed a refresh-enabled CML plan with
IOSXE_INSECURE=false across 22 imported resources, with zero changes.