FIPS: support Go's native FIPS 140-3 module (GOFIPS140) in the fips package

The fips package unconditionally imports crypto/boring, which does not compile on a native-module toolchain (stdlib files are //go:build boringcrypto), and Enabled() reports false under GOFIPS140 builds. This blocks every component that builds with -tags fips on the new toolchain, and gitlab-shell's SSH algorithm selection depends on it functionally.

V1

• Land !582 (merged) (split crypto/boring behind build tags; Enabled() = boring OR crypto/fips140)
• Tag a release consumable by gitaly, gitlab-shell, gitlab-pages, and workhorse

V2

• Land !595 (merged) (new v2/fips + v2/fips/sshalgo; ActiveBackend() posture detection) — merged 2026-08-12
• Tag a release consumable by gitaly, gitlab-shell, gitlab-pages, and workhorse — v2.33.0 (auto-tagged 2026-08-12)

V1 follow-ups (found while porting to V2; both GOFIPS140-specific)

• Land !594 (merged) — x/crypto/ssh leaks a zeroed slice tail into SupportedAlgorithms().Ciphers on GOFIPS140 builds — merged 2026-08-10
• Land !598 (merged) — apply SSH algorithm policy per FIPS backend: gate X25519 key agreement (incl. the ML-KEM768/X25519 hybrid) on every backend, and filter public key auth algorithms under the native module — merged 2026-08-12
• Tag a V1 release carrying both, consumable by gitaly, gitlab-shell, gitlab-pages, and workhorse — v1.64.11 (auto-tagged 2026-08-12)

Context for !598 (merged): upstream Go approves the ML-KEM768/X25519 hybrid under fips140=on, but X25519 key agreement is excluded from SP 800-56Arev3 (FIPS 140-3 IG, established in !216 (merged)) and panics on the golang-fips toolchain (c91581b1). Deferring to the module would have silently reversed that determination, so GitLab's exclusion list is applied on every backend. The same policy shipped in V2 via !595 (merged).

Part of &22761 (spike: https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706).

🤖 Generated with Claude Code