[19.3-stable] Force GOFIPS140=off for the golang-fips toolchain

What does this MR do?

Force GOFIPS140=off for the golang-fips toolchain

CNG 19-3-stable builds the golang-fips fork at the go1.26.10-1-openssl-fips tag, which ships 012-default-fips-snapshot.patch. That patch flips the unset GOFIPS140 default from "off" to "certified", so Go now rejects GOEXPERIMENT=boringcrypto (forced for FIPS components) with:

go: use of GOEXPERIMENT=boringcrypto requires GOFIPS140=off

Write GOFIPS140=off into the toolchain's go.env to restore the prior default, keeping boringcrypto building against OpenSSL with no crypto module change. CNG 19-4-stable and master already use native Go FIPS and are unaffected.

See https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/10164+s

Signed-off-by: Stan Hu stan@gitlab.com

Related issues

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

• Merge Request Title, and Description are up to date, accurate, and descriptive
• MR targeting the appropriate branch
• MR has a green pipeline on GitLab.com
• When ready for review, MR is labeled "~workflow::ready for review" per the Distribution MR workflow

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes
• Documentation created/updated
• Integration tests added to GitLab QA
• The impact any change in container size has should be evaluated
• New dependencies are managed with GitLab forked renovatebot