Updates to FIPS documentation

Benjamin Darnell (bdarnell) commented:

Each of our FIPS builds requires a specific version of OpenSSL: CockroachDB version 23.1 and earlier require OpenSSL 1.1, while version 23.2 will require OpenSSL 3.0. This corresponds to a change in Red Hat's Universal Base Image versions: `ubi8` contains OpenSSL 1.1, while `ubi9` contains OpenSSL 3.0.

1. We should encourage the use of our docker images for FIPS use cases. Our docker images will always contain the correct OpenSSL version and using containers makes upgrades much easier.
2. References to "Universal Base Image 8" should be updated to version 9 for 23.2
3. References to Red Hat Enterprise Linux also need version qualifiers (8 or 9, same as for UBI)

Upgrades are tricky unless docker containers are used. For RHEL, each machine must be upgraded to RHEL9 *before* upgrading to CRDB 23.2. During that upgrade process (before restarting CRDB), the `compat-openssl11` package must be installed. After this is done, CRDB 23.1 can be restarted, and then the upgrade to 23.2 can be done as usual. (After the upgrade to 23.2 is complete, the package `compat-openssl11` is no longer needed).

Also FYI, I plan to introduce new options to CRDB to verify that FIPS mode is configured correctly: https://github.com/cockroachdb/cockroach/issues/114344. This will take the place of the "Verify that CockroachDB is FIPS-ready". You'll probably want to wait until this is available to begin work on this doc but I'm filing the issue now to put it on your radar.

Jira Issue: DOC-9211