feat: add FIPS 140-3 build support for jetstream-controller

[mkm29]

Description:

Summary

Adds a FIPS 140-3 compliant container image for jetstream-controller, published as jetstream-controller:<tag>-fips alongside the existing images. Built with Go's native, CMVP-validated Go Cryptographic Module v1.0.0 (Certificate #5247) via GOFIPS140=v1.0.0 — no cgo, no toolchain fork, no changes to the existing (non-FIPS) builds.

Changes

• .goreleaser.yml: new jetstream-controller-fips build id — same source and ldflags, built with GOFIPS140=v1.0.0 and running in FIPS mode by default (fips140=on). Binary is named jetstream-controller-fips because cicd/Dockerfile selects artifacts by binary name.
• docker-bake.hcl:
  • jetstream-controller-fips target (in the default group, so CI picks it up with no workflow changes), reusing cicd/Dockerfile unchanged.
  • Compat symlinks /usr/local/bin/jetstream-controller and /jetstream-controller → the FIPS binary (via dockerfile-inline, same pattern as nats-boot-config), so command/path overrides keep working.
  • Helpers: get_tags_suffix() for the -fips tag scheme, get_platforms_fips() for the reduced platform matrix.

Verification

• goreleaser check and docker buildx bake --print pass.
• Full local build of the FIPS target succeeds; container runs --version via the compat symlink (FIPS module self-tests execute at startup).
• go version -m on the extracted binary confirms linkage: GOFIPS140=v1.0.0, build tag fips140v1.0, DefaultGODEBUG=…fips140=on….
• Tests pass: GODEBUG=fips140=only GOFIPS140=v1.0.0 make test

go vet ./controllers/... ./pkg/natsreloader/... ./internal/controller/...
/Users/mitchellmurphy/Developer/github.com/mkm29/nack/bin/setup-envtest-release-0.20 use 1.32.0 --bin-dir /Users/mitchellmurphy/Developer/github.com/mkm29/nack/bin -p path ## Get k8s binaries
/Users/mitchellmurphy/Developer/github.com/mkm29/nack/bin/k8s/1.32.0-darwin-arm64go test -race -cover -count=1 -timeout 30s ./controllers/... ./pkg/natsreloader/... ./internal/controller/...
ok      github.com/nats-io/nack/controllers/jetstream   7.061s  coverage: 49.2% of statements
ok      github.com/nats-io/nack/pkg/natsreloader        5.891s  coverage: 67.7% of statements
ok      github.com/nats-io/nack/internal/controller     11.734s coverage: 65.9% of statements