Build releases against the FIPS 140-3 validated Go crypto module (#6262)

## Changes

Build released binaries with `GOFIPS140=v1.0.0`. This links the FIPS
140-3 validated Go Cryptographic Module into the binary and defaults
FIPS 140-3 mode on, so no runtime flag is needed.

## Why

Regulated environments (FedRAMP, IL5) require cryptography to come from
a validated module. This has to be set at build time: the runtime
`GODEBUG=fips140=on` only toggles the mode on whatever module was
already linked, so without the build variable, there is no validated
module in the binary and no certificate to cite.

Pinned to a frozen version rather than an alias. `v1.0.0` is the version
covered by CMVP certificate `#5247`

This changes behavior for everyone, not just regulated users: the TLS
client offers only FIPS-approved suites (6 instead of 13, dropping
ChaCha20 and CBC)

CI coverage for the FIPS build is added separately in #6193

## Tests

Ran the whole unit and acceptance suite against a FIPS build — no
failures. Also confirmed all six release targets (linux/darwin/windows x
amd64/arm64) cross-compile with the variable set; none of the platforms
Go excludes from FIPS mode are in our matrix.

_This PR was written by Claude Code._

Author: ilyakuz-db

.goreleaser.yaml

@@ -7,6 +7,13 @@ before:
 builds:
   - env:
       - CGO_ENABLED=0
+      # Link the Go Cryptographic Module and default FIPS 140-3 mode on. Pinned to
+      # a frozen version rather than an alias: only v1.0.0 carries a CMVP
+      # certificate, "latest" tracks the in-tree source with no fixed artifact to
+      # cite, and "certified" is resolved by the toolchain so it moves on upgrade.
+      # Callers who need the previous behaviour can start the binary with
+      # GODEBUG=fips140=off.
+      - GOFIPS140=v1.0.0
     mod_timestamp: '{{ .CommitTimestamp }}'
     flags:
       - -trimpath

.nextchanges/cli/fips140.md

@@ -0,0 +1 @@
+Released binaries are now built against the FIPS 140-3 validated Go Cryptographic Module, with FIPS 140-3 mode enabled by default. TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 and CBC from what the client offers. FIPS mode can be disabled at startup with `GODEBUG=fips140=off`, which restores the previous TLS behaviour ([#6262](https://github.com/databricks/cli/pull/6262)).