Build the Go toolchain using allowcryptofallback

[qmuntal]

allowcryptofallback can be used to allow executing the Go toolchain with GOFIPS=1, e.g. GOFIPS=1 go test ., even when the Go toolchain itself is not built with GOEXPERIMENT=systemcrypto.

Reusing allowcryptofallback allows us to drop patch 7, which was tackling the same issue with a more intrusive and less robust approach: unsetting GOFIPS when the runtime was initializing and setting it again every time a child process was spawned.

This will help migrating from GOFIPS to GODEBUG=fips140.

These changes uncovered a latent bug in the Go toolchain: GOFIPS was not being honored, for a reason that I still not understand, the Go toolchain didn't pass the GOFIPS env var to child processes. Note that this bug doesn't affect setting GOFIPS in production environments, only when running commands like go test, go run, or go tool dist test.

Now that GOFIPS actually does something when running go tool dist test (which we execute in CI to run all the toolchain tests), Mariner 1 and Mariner 2 builders started to fail (see logs) due to FIPS mode not being enabled (remember that we removed the openssl.SetFIPS(true) call in #1496, so we no longer enable FIPS mode on demand). To fix this, I've updated the builder scripts so that it enables FIPS mode before running the tests by setting the Mariner/AZL3 specific OPENSSL_FORCE_FIPS_MODE env var. Note that we already do something similar on Windows, where FIPS mode is enabled by modifying the system registry.

For #1445.

[dagood]

Hmm, wonder if this patch would also let us remove this, to simplify:

go/eng/_util/buildutil/buildutil.go

Lines 89 to 97 in 88aa286

	// If the experiment enables a crypto backend, allow fallback to Go crypto. Go turns off cgo
	// and/or cross-builds in various situations during the build/tests, so we need to allow for it.
	if strings.Contains(experiment, "opensslcrypto") ||
	strings.Contains(experiment, "cngcrypto") ||
	strings.Contains(experiment, "boringcrypto") ||
	strings.Contains(experiment, "darwincrypto") ||
	strings.Contains(experiment, "systemcrypto") {
	experiment += ",allowcryptofallback"