go: Update module gitlab.com/gitlab-org/labkit to v1.64.11

What does this MR do and why?

Updates gitlab.com/gitlab-org/labkit from v1.64.1 to v1.64.11.

labkit v1.64.1's fips package imports crypto/boring unconditionally, which breaks -tags fips builds on Go toolchains that use the native FIPS 140-3 module (GOFIPS140) instead of boringcrypto:

package gitlab.com/gitlab-org/gitaly/v18/internal/cli/gitaly
        imports gitlab.com/gitlab-org/labkit/fips
        imports crypto/boring: build constraints exclude all Go files in .../src/crypto/boring

• labkit v1.64.9 splits the crypto/boring usage behind boringcrypto build tags; fips.Enabled() now reports enabled when either boringcrypto or the native module (crypto/fips140) is active.
• labkit v1.64.10 additionally filters out empty SSH algorithm names leaked by x/crypto under GOFIPS builds.
• labkit v1.64.11 applies the SSH algorithm policy per FIPS backend (labkit!598 (merged)).

This complements the merged Makefile guard !8992 (merged) and unblocks building Gitaly with -tags fips on native GOFIPS140 toolchains.

Notes:

• labkit v1.64.11 declares go 1.25.8, so the go directive is raised to match (same as the pending renovate MR !8946 (closed), which only goes to v1.64.9 and lacks the SSH fix).
• The labkit/v2 pseudo-version pin is intentionally left untouched (v2 has no fips package).

Empirical verification (darwin/arm64, Go 1.25.12)

Command	v1.64.1 (before)	v1.64.11 (after)
go build ./...	pass	pass
go vet ./...	pass	pass
GOFIPS140=v1.0.0 go build -tags fips ./internal/cli/gitaly/	fail (imports crypto/boring: build constraints exclude all Go files)	pass
GOFIPS140=v1.0.0 go build -tags fips ./cmd/...	fail	pass
GOFIPS140=v1.0.0 go build -tags fips ./...	fail	pass

Related to #7305 (closed)

Part of &22761 (closed)

Update 2026-08-13: retargeted from v1.64.10 to v1.64.11, which adds the per-FIPS-backend SSH algorithm policy from labkit!598 (merged); all builds re-verified.

🤖 Generated with Claude Code