feat: build windows and linux binaries with fips enabled Microsoft Go Fork

[asaf92]

• Follows CONTRIBUTING rules

What does this PR do?

• This PR introduces a new way to download and install the golang version used for building the CLI.
• This enables to use different golang versions besides the google version, we are looking towards using the MS Go Fork in the future.
• It also includes some pipeline refactorings to unify the build job.
• In addition it supports detecting the GOEXPERIMENT values introduced in the MS Go Fork to enable FIPS validated crypto.

Where should the reviewer start?

The different build steps should include log messages like this

-- Pre-paring to build
--  Using Go:        ***/go/bin/go
--  Building Binary: ***/snyk/cliv2/_bin/snyk-linux
--  GOEXPERIMENT:    

The download go binary step should include
--base_url=https://go.dev/dl/

How should this be manually tested?

Currently this doesn't include a behavioural or functional change.

Any background context you want to provide?

What are the relevant tickets?

HEAD-392, HEAD-395

Screenshots

[bastiandoetsch]

Consider using gzip encoding: https://gist.github.com/Manouchehri/0ce55d239fb07c41c92f. Alternatively, the requests library does it automatically. On the other hands, I just saw that it's compressed files anyway, so the benefits would be minuscule.

[bastiandoetsch]

Shasum checking would be awesome!

[bastiandoetsch]

Also, as we're talking about FIPS functionality, do the go providers provide GPG keys to check?

[j-luong]

Looks like it's possible from big G. we can fetch the asc like so:
https://storage.googleapis.com/golang/go1.20.linux-amd64.tar.gz.asc

It's not well documented, but the public key to verify looks like it can be fetched like so:
https://dl.google.com/dl/linux/linux_signing_key.pub

MSFT has signatures available via their download URL, e.g. https://aka.ms/golang/release/latest/go1.20.linux-amd64.tar.gz.sig

And can be validated using their public key:

Validate GPG signatures using our public key:

https://download.microsoft.com/download/f/a/2/fa2420dd-3f08-4621-82cf-5a22abcbc8f9/microsoft-managed-lang-compiler.asc
Shortened link for sharing: https://aka.ms/managed-lang-compiler-public-key

[bastiandoetsch]

Lets do gpg in a follow-up PR/Story, using aharc-coded public keys in config.yaml and validate on each platform using the given key.