[v17] feat: Allow non-FIPS endpoints on FIPS binaries

[codingllama]

Backport #51924 to branch/v17.

Changelog: Added an escape hatch to allow non-FIPS AWS endpoints on FIPS binaries (TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes).

[codingllama]

Backported with various conflicts, as expected.

• Adding new code: clean cherry-pick (e61255b)
• forbidigo rules: conflicts on .golangci.yml (c9e1774)
• Use stsutils functions: re-written using the same original gofmt rules (see below)
• Use dynamodbutils: cherry-pick with conflicts: no FIPS options on the stream client (dynamodbbk.go), no FIPS field on lib/srv/db/dynamodb/engine.go (d385de5)

gofmt rules:

gofmt -r 'sts.NewFromConfig -> stsutils.NewFromConfig' -w **/*.go
gofmt -r 'sts.New -> stsutils.NewV1' -w **/*.go

# plus some cleanups, fixing imports, etc

Expect a similar procedure for v16 (only I'll likely cherry-pick from v17, as it has a better chance of working).