Build releases against the FIPS 140-3 validated Go crypto module

[ilyakuz-db]

Changes

Build released binaries with GOFIPS140=v1.0.0. This links the FIPS 140-3 validated Go
Cryptographic Module into the binary and defaults FIPS 140-3 mode on, so no runtime flag is
needed.

Why

Regulated environments (FedRAMP, IL5) require cryptography to come from a validated module.
This has to be set at build time: the runtime GODEBUG=fips140=on only toggles the mode on
whatever module was already linked, so without the build variable, there is no validated module
in the binary and no certificate to cite.

Pinned to a frozen version rather than an alias. v1.0.0 is the version covered by CMVP
certificate #5247

This changes behavior for everyone, not just regulated users: the TLS client offers only
FIPS-approved suites (6 instead of 13, dropping ChaCha20 and CBC)

CI coverage for the FIPS build is added separately in #6193

Tests

Ran the whole unit and acceptance suite against a FIPS build — no failures. Also confirmed all
six release targets (linux/darwin/windows x amd64/arm64) cross-compile with the variable set;
none of the platforms Go excludes from FIPS mode are in our matrix.

This PR was written by Claude Code.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @janniklasrose -- recent work in .nextchanges/notable-changes/, ./

Eligible reviewers: @andrewnester, @anton-107, @denik, @lennartkats-db, @pietern, @rclarey, @renaudhartert-db, @rugpanov, @shreyas-goenka, @simonfaltum

_{Suggestions based on git history. See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: 066e974

Run: 31700956905

	Env	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux	4	4	286	1143	4:58
💚​	aws windows	4	4	288	1141	3:21
💚​	azure linux	4	4	285	1143	5:50
💚​	azure windows	4	4	287	1141	4:29
💚​	gcp linux	1	5	286	1143	5:40
💚​	gcp windows	1	5	288	1141	5:04

8 interesting tests: 4 RECOVERED, 4 SKIP

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R

Top 6 slowest tests (at least 2 minutes):

duration	env	testname
4:53	gcp windows	TestAccept
4:22	azure windows	TestAccept
3:13	aws windows	TestAccept
3:01	gcp linux	TestAccept
2:59	azure linux	TestAccept
2:56	aws linux	TestAccept