Support Go native FIPS 140 mode (GODEBUG=fips140=only)

Go 1.24 introduced native FIPS 140-3 support via GODEBUG=fips140=only, which rejects all non-FIPS algorithms at runtime, including crypto/sha1.

cfssl uses SHA-1 in several hardcoded places that can't be configured:

1. ComputeSKI(): hardcoded sha1.Sum() for SubjectKeyId computation, no option to use SHA-256
2. FillTemplate(): unconditionally calls ComputeSKI(), overwriting any pre-set SubjectKeyId
3. Various helpers: use crypto primitives that trigger fips140=only panics

While SHA-1 for SKI is recommended by RFC 5280 §4.2.1.2, it's not mandatory, the RFC allows any method that provides unique identification. SHA-256 truncated to 20 bytes is a FIPS-compliant alternative.

Suggested fixes (any of): - Make the SKI hash algorithm configurable (default SHA-1, option for SHA-256) - Don't overwrite SubjectKeyId in FillTemplate if the caller already set it - Detect fips140=only at runtime and switch to SHA-256 automatically