Support Go native FIPS 140 mode (GODEBUG=fips140=only)

Go 1.24 introduced native FIPS 140-3 support via `GODEBUG=fips140=only`, which rejects all non-FIPS algorithms at runtime, including `crypto/sha1`.

cfssl uses `SHA-1` in several hardcoded places that can't be configured:

1. `ComputeSKI()`: hardcoded `sha1.Sum()` for `SubjectKeyId` computation, no option to use SHA-256
2. `FillTemplate()`: unconditionally calls `ComputeSKI()`, overwriting any pre-set SubjectKeyId
3. Various helpers: use crypto primitives that trigger `fips140=only` panics

While SHA-1 for SKI is recommended by [`RFC 5280 §4.2.1.2`](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2:~:text=Other%20methods%20of%20generating%20unique%20numbers%20are%20also%20acceptable.), it's not mandatory, the RFC allows any method that provides unique identification. SHA-256 truncated to 20 bytes is a FIPS-compliant alternative.

Suggested fixes (any of):
- Make the SKI hash algorithm configurable (default `SHA-1`, option for `SHA-256`)
- Don't overwrite `SubjectKeyId` in `FillTemplate` if the caller already set it
- Detect `fips140=only` at runtime and switch to SHA-256 automatically

Locate ComputeSKI, FillTemplate, and the other cryptographic helpers named in the issue, then inspect their callers and run the relevant package tests with GODEBUG=fips140=only. Confirm which suggested approach is selected; done means cfssl operates in native FIPS mode without non-FIPS runtime failures while preserving the default behavior unless configured otherwise.

Written by the indexing model from the issue text.