FIPS: support Go native FIPS 140-3 module (GOFIPS140) toolchains

Under FIPS_MODE=1 the Makefile probes and exports GOEXPERIMENT=boringcrypto, which cmd/go refuses to combine with GOFIPS140 — breaking builds on GOFIPS140 toolchains (CNG failure: https://gitlab.com/gitlab-org/build/CNG/-/jobs/15232574018).

• Land !8992 (merged) (guard boringcrypto behind go env GOFIPS140 empty-or-off)
• Bump labkit once its fips fix is released (stock labkit fails to compile with -tags fips on native toolchains) — !9076 (merged) merged 2026-08-20 (v1.64.11)
• Verify native FIPS build of gitaly/praefect (the -tags fips binaries) — verified 2026-08-20: CNG FIPS pipeline job https://gitlab.com/gitlab-org/build/CNG/-/jobs/16012952146 built gitaly master (labkit v1.64.11) green on the native GOFIPS140 toolchain

Part of &22761 (closed) (spike: https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706).

🤖 Generated with Claude Code