Reliability of Calderbank-Shor-Steane codes and security of quantum key distribution