feat(golang): detect native Go FIPS 140 mode in binaries

[gunnypatel]

Description

Go 1.24 introduced a native FIPS 140-3 mode, selected at build time via the GOFIPS140 build flag and at run time via the fips140 GODEBUG setting. Both are recorded in the binary's build info (GOFIPS140 and the fips140= entry within DefaultGODEBUG).

Syft's existing Go crypto detection only recognized the older BoringCrypto / crypto/tls/fipsonly markers, so binaries built with the new native FIPS mode were reported with no FIPS-related crypto settings at all.

This adds a getNativeFIPSSettings helper that reads those two build settings and appends them to the existing goCryptoSettings metadata field, e.g.:

goCryptoSettings:
  - GOFIPS140=v1.0.0
  - GODEBUG=fips140=on

No new metadata field or JSON schema version is needed — the values populate the existing goCryptoSettings list.

Type of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections