Add ms_tls13kdf buildtag for FIPS builds

[michel-laterman]

What does this PR do?

Add the ms_tls13kdf build tag to FIPS builds.

Why is it important?

microsoft/go TLSv1.3 kdf support (microsoft/go#1662) requires the ms_tls13kdf build tag.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[pchila]

Shouldn't the tag ms_tls13kdf be used for building the elastic-agent binary ? I don't think I saw that in the diff

[nicholasberlin]

LGTM FWIW

[ycombinator]

Should we also check for ms_tls13kdf around here?

elastic-agent/dev-tools/packaging/testing/package_test.go

Line 759 in 9548b96

require.Contains(t, setting.Value, "requirefips")

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 9b779e8

Failed CI Steps

• Packaging: Ubuntu x86_64 FIPS
• Packaging: Ubuntu x86_64 FIPS
• Packaging: Ubuntu arm64 FIPS
• Packaging: Ubuntu arm64 FIPS

History

• 💔 Build #21024 failed c8a0127
• 💛 Build #20972 was flaky 0ca8360

cc @michel-laterman

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[cmacknz]

This new tag has no effect on the generation of the FIPS notice file because there are no packages whose inclusion are conditional on the use of this tag? Correct?

elastic-agent/dev-tools/mage/target/common/notice.go

Lines 38 to 39 in 804f1ee

	if err := generateNotice(notice.FIPSNoticeFilename, "requirefips"); err != nil {
	return fmt.Errorf("failed to generate %s: %w", notice.FIPSNoticeFilename, err)

We are only filtering on requirefips, just double checking adding another tag to the FIPS build doesn't affect the FIPS notice file.