feat(build): validate FIPS mode at build time and runtime

[swiatekm]

This adds an additional file to the main package which:

1. Imports a module that is supposed to guarantee that we're always running in FIPS mode: https://go.googlesource.com/go/+/dev.boringcrypto/src/crypto/tls/fipsonly/fipsonly.go
2. Adds an init check for whether we're using BoringSSL and prints a log line if so

It's not clear whether this is a good enough solution to attest that we're running in FIPS mode. Maybe we should also add a test that tries to use a FIPS-incompatible cipher for TLS and fails?

[sumo-drosiek]

Maybe we should also add a test that tries to use a FIPS-incompatible cipher for TLS and fails?

That would be nice, but I think it can be done as separate PR

[swiatekm]

Maybe we should also add a test that tries to use a FIPS-incompatible cipher for TLS and fails?

That would be nice, but I think it can be done as separate PR

I actually checked this, and it requires doing a more involved integration test - we'd need to start the collector with a receiver/exporter and make assertions about what they send over TLS.

[sumo-drosiek]

Maybe we should also add a test that tries to use a FIPS-incompatible cipher for TLS and fails?

That would be nice, but I think it can be done as separate PR

I actually checked this, and it requires doing a more involved integration test - we'd need to start the collector with a receiver/exporter and make assertions about what they send over TLS.

So, let's create an issue 😅