Nodes use FIPS STS endpoints for IAM join method when in FIPS mode

[nklaassen]

When nodes join a Teleport cluster using the IAM join method, they generate a signed sts:GetCallerIdentity request and send it to the Teleport auth server, which finally sends the signed request to the actual AWS endpoint which will return the verified identity of the node.

The exact AWS endpoint is necessarily part of the signed request, and must be selected on the client. Since #15337, nodes will attempt to use the regional STS endpoint of their local AWS region, such as https://sts.us-west-2.amazonaws.com. Before that change, nodes would always use the global endpoint https://sts.amazonaws.com.

The STS service has 4 specific FIPS endpoints sts-fips.us-east-1.amazonaws.com, sts-fips.us-east-2.amazonaws.com, sts-fips.us-west-1.amazonaws.com, and sts-fips.us-west-2.amazonaws.com. We should use these endpoints when in FIPS mode, but until now we have not done so (I didn't realize there were separate FIPS endpoints until recently.)

With this change, nodes running in FIPS mode will select a FIPS endpoint. If they are running in a region with a local FIPS endpoint, that will be used, otherwise the us-east-1 FIPS endpoint will be used.

All GovCloud STS endpoints are already FIPS compliant.

As far as I can tell, there are no FIPS endpoints for the AWS China partition, so we cannot support FIPS mode with the IAM join method in China.

In a following PR #16124, the auth server will enforce that FIPS endpoints are always used. This could break cross-version compat between minor versions, so it is being split into a separate PR and will not be backported.

I wanted to write a test for a PR, but all of the interesting logic is in configuring the AWS SDK to generate the right endpoint, and the SDK relies on having AWS credentials. If we mocked out the SDK, all we could really test would be the mock. Let me know if you see a decent/useful way to test this.

I manually tested this change in a region with a local FIPS endpoint (us-west-2), without a local FIPS endpoint (ca-central-1), and in GovCloud (us-gov-west-1).

re: #15927

[nklaassen]

friendly ping @lxea

[github-actions]

@nklaassen See the table below for backport results.

Branch	Result
branch/v10	Create PR
branch/v8	Failed
branch/v9	Failed