Support GOFIPS140 build time opt-in to FIPS

Before 1.24, the API to opt into boringcrypto is:

```
go_download_sdk(
name = "go_sdk",
experiments = ["boringcrypto"],
...
)
```
The new API is to set the `GOFIPS140` variable and the `GOEXPERIMENT` is going to go away in an upcoming release. How should we support this in rules_go?

Start by tracing the go_download_sdk entry point and the existing experiments=["boringcrypto"] handling. Determine how rules_go should accept the GOFIPS140 variable as GOEXPERIMENT is removed, and consider the compatibility behavior that the completed change must provide.

Written by the indexing model from the issue text.