chore: enable fips compliance

[ijovovic]

Description

Changes proposed in this pull request:

• enable fips140 compliance

[hyperspace-insights]

Summary

This PR introduces FIPS 140 compliance to the build and runtime environment, which is a significant security and compliance change. However, several critical issues need to be addressed:

Major Concerns:

1. Lack of documentation - No explanation of why FIPS mode is required or what impact it has
2. Inconsistent configuration - FIPS settings differ between build, test, and runtime environments, which could lead to tests passing while production fails
3. Hardcoded versions - The FIPS module version is hardcoded without justification or configurability
4. Security implications unclear - Disabling ML-KEM (post-quantum crypto) and enforcing FIPS-only mode are significant decisions that need explanation
5. Missing validation - No evidence that the application has been tested in FIPS-only mode

Recommendations:

• Add comprehensive documentation about FIPS requirements and implementation
• Ensure consistent FIPS configuration across all build/test/runtime scenarios
• Consider making FIPS version configurable
• Validate that all cryptographic operations in the codebase are FIPS-compliant
• Add integration tests specifically for FIPS mode

Please address these concerns before merging to ensure the FIPS implementation is robust and maintainable.

PR Bot Information

Version: 1.15.19

• Correlation ID: 32093360-ce98-11f0-88b8-fb1367eb2888
• Event Trigger: issue_comment.created