Support GOFIPS140 build time opt-in to FIPS

Before 1.24, the API to opt into boringcrypto is:

```
go_download_sdk(
    name = "go_sdk",
    experiments = ["boringcrypto"],
    ...
)
```
The new API is to set the `GOFIPS140` variable and the `GOEXPERIMENT` is going to go away in an upcoming release. How should we support this in rules_go?