fix: harden CLI security defaults

[bgdnvk]

Summary

• upgrade vulnerable transitive security modules and harden local secret/state file permissions
• redact credential/config display paths and validate local/API URLs before HTTP calls
• replace insecure SSH host-key handling, add crypto-random jitter, guard raw JSON responses, and harden Terraform/BigQuery/path handling

Verification

• go test ./...
• go build -o /tmp/clanker-security-audit .
• go run golang.org/x/vuln/cmd/govulncheck@latest ./...
• git diff --check

Security scan notes

• govulncheck reports 0 reachable vulnerabilities
• gosec still reports broad static-analysis categories around command wrappers, user-supplied paths, public IDs/test strings, intentional executable installer chmods, and taint warnings on already-normalized URLs