Transitioning from MD5 to SHA-256 in the filestat input plugin

### **Use Case**

The Telegraf filestat input plugin currently utilizes Go's standard library crypto/md5 to allow users to optionally collect and report file checksums as metrics. While this use case is strictly non-cryptographic (used primarily for file integrity monitoring and drift detection), maintaining reliance on legacy hashing algorithms introduces technical debt, operational risks, and compatibility limitations as enterprise environments evolve.

### **Purposes**

- File Integrity Metrics: Used in plugins/inputs/filestat/filestat.go to calculate the MD5/SHA1 hash of target files on disk and export the hexadecimal string representation to configured output sinks (e.g., InfluxDB, Prometheus).

- Security Baseline Verification: Used to continuously validate the exact state of files against a trusted security baseline. It flags any drift or unauthorized divergence, requiring a robust, collision-resistant hash to ensure the collected telemetry cannot be spoofed or bypassed by an attacker.

### **Motivation**

- Eliminating Weak Cryptographic Primitives: MD5 and SHA-1 have long been proven vulnerable to collision attacks. Even though file monitoring is categorized as an observability task, exporting weak hashes allows potential attackers to craft files with matching MD5 signatures (hash collisions) to bypass integrity checks or spoof file metrics, masking malicious unauthorized modifications.

- Securing the Runtime Environment: Modern secure-by-default runtime environments and security tools increasingly flag or outright block the usage of weak hashing functions like crypto/md5. Maintaining these legacy dependencies in core plugins risks triggering static analysis security alerts (SAST), software supply chain flags, or unexpected runtime panics when deployed in hardened infrastructure.

- Modernizing Telemetry Defaults: Transitioning to SHA-256 ensures that file verification relies on a cryptographically secure primitive, eliminating structural security debt and aligning Telegraf with modern industry-standard security practices.

### Expected behavior

When configuring the filestat plugin to monitor file integrity, users should be able to utilize strong, modern cryptographic hashing primitives (such as SHA-256) out of the box to comply with modern security best practices and prevent telemetry spoofing.

Furthermore, security-conscious environments should have a native configuration pathway to completely disable and avoid instantiating legacy, cryptographically broken algorithms like MD5 at runtime without breaking the overall plugin functionality.

### Actual behavior

Currently, the filestat plugin only supports legacy and weak hashing algorithms via the md5 configuration booleans.

As a result:

- Security scanners and hardened runtime environments flag the code dependency on crypto/md5 as a security risk/technical debt.

- There is no built-in mechanism to collect modern SHA-256 integrity metrics for files, forcing users to accept weak primitives that are theoretically vulnerable to collision attacks or metric spoofing if they want to use this plugin for integrity monitoring.

### Additional info

_No response_

Start in plugins/inputs/filestat/filestat.go, focusing on the existing md5 configuration booleans and checksum collection path. Determine how SHA-256 should be exposed and how legacy algorithms can be disabled without breaking the plugin. Done means file integrity metrics support a modern hash and provide the requested configuration pathway.

Written by the indexing model from the issue text.