Double-check FIPS mode is enabled during FIPS mode test jobs

As of writing, https://github.com/microsoft/go-infra-images/blob/main/src/cbl-mariner/1.0.20211027/fips/Dockerfile sets GOLANG_FIPS=1, so we can use that image to test Go under FIPS mode. If FIPS mode engages but hits a problem (incompatible OpenSSL, bad changes in PR, etc.) we would know because Go would fail tests trying to initialize it.

Potential brittleness that could get through:

• If GOLANG_FIPS=1 is renamed in the prereq image, or somehow not set properly, we wouldn't end up testing in FIPS mode in the Go repo. We'd just be running non-FIPS tests twice.
• If the GOLANG_FIPS env variable is renamed in Go, or somehow not detected properly, we would be in the same situation.

We can manually confirm that FIPS tests are running by looking for "Passed" tests in the CI results UI that only run in FIPS mode, like TestUnreachable in https://github.com/microsoft/go/pull/324#issuecomment-996104548. Our CI should do something like that.

Start by reviewing the FIPS test jobs and the prereq image's fips/Dockerfile, then inspect the FIPS-only TestUnreachable example and existing CI result handling. Done means CI reliably fails when FIPS mode is not actually engaged, including when GOLANG_FIPS is renamed or missing.