Publish official FIPS-enabled Docker image variant

**Title**: Publish official FIPS-enabled Docker image variant

**Description**:

The Envoy build system already supports FIPS via `--config=boringssl-fips` and
`--config=aws-lc-fips`. The ask is to publish an additional image variant built
with one of those flags as part of the standard release pipeline — no codebase
changes required.

**Desired behavior:**

A `-fips` tagged image published alongside each standard release, e.g.:

envoyproxy/envoy:distroless-fips-v1.X.Y

Built with `--config=aws-lc-fips` (preferred — broader architecture support than
`--config=boringssl-fips`, which is Linux x86_64 only).

**Scenario it enables:**

Organizations with FIPS 140 compliance requirements currently have no official
path to a FIPS-enabled Envoy image. Existing options are either EOL (AWS App Mesh
`prod-fips`, discontinued September 2026), commercial-only (Tetrate, Solo.io), or
require teams to own and maintain a self-build pipeline.

**Relevant links:**

- FIPS build documentation: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
- AWS App Mesh FIPS EOL: https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

Start with the linked FIPS build documentation and the standard release pipeline entry points; the issue does not name specific files or tests. Verify how the pipeline selects `--config=aws-lc-fips` and publishes image tags, then confirm a `distroless-fips-v1.X.Y` image is built and published alongside each standard release for the supported architectures.

Written by the indexing model from the issue text.