feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)

# Which Problems Are Solved

Enable FIPS 140-3 compliant build.

# How the Problems Are Solved

- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
  - Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:

```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
  
# Other changes

- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
 
# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images

.github/workflows/release.yml

@@ -103,12 +103,21 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_api }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips-debug \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_login }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }}-fips \
+          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
     -
       name: Publish latest
       if: ${{ github.ref_name == 'next' }}
@@ -122,6 +131,15 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:latest \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:latest-fips \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:latest-fips-debug \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_login }}:latest-fips \
+          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
 
   homebrew-tap:
     runs-on: ubuntu-22.04