Export GOFIPS140 in the registry, gitlab-kas, and gitlab-elasticsearch-indexer builds

Follow-up to #10002 (closed).

Problem

When USE_GO_FIPS_MODULE=true, only four software definitions export GOFIPS140: gitaly, gitlab-pages, gitlab-rails, and gitlab-shell.

The builds of registry, gitlab-kas, and gitlab-elasticsearch-indexer do not receive GOFIPS140. The builder images supply standard Go. As a result, these three binaries compile without the Go FIPS module, but they ship in a FIPS package.

Evidence from the toggle test on 2026-09-09 (https://gitlab.com/gitlab-org/omnibus-gitlab/-/jobs/16399836115):

  • The job trace shows GOFIPS140="v1.0.0" for the four components above only.
  • The registry build environment shows only GOTOOLCHAIN="local".

Task

Apply the existing pattern to the three remaining Go software definitions.

  • Add this line to config/software/registry.rb, config/software/gitlab-kas.rb, and config/software/gitlab-elasticsearch-indexer.rb:

    env['GOFIPS140'] = Build::Check.go_fips_module_version if Build::Check.use_go_fips_module?

    Use config/software/gitaly.rb (line 98) as the reference. Note: registry.rb and gitlab-kas.rb build their environment as a plain hash. Add the export after the hash assignment.

  • Run the golang-fips-native-toggle-test harness again, with USE_GO_FIPS_MODULE=true and FIPS_BUILDER_IMAGE_SUFFIX="".

  • Make sure the job trace shows GOFIPS140="v1.0.0" for all seven Go components.

Out of scope

  • A central, process-level export. The decision on #10002 (closed) keeps the per-recipe pattern.
  • A change to the default value of USE_GO_FIPS_MODULE.