crypto/x509: respect GODEBUG changes during program lifetime

[rsc]

For #41682 we allow GODEBUG=x509sha1=1 to reenable SHA1 certificate support.
But programs cannot use os.Setenv at startup, because the SHA1 behavior is loaded
into a global variable during func init in crypto/x509, apparently to make testing easier.
We should tweak the code to check GODEBUG as needed, and then we should backport the change.

Among other things, this will help Kubernetes update older releases to newer Go versions.

[rsc]

@gopherbot please backport

[gopherbot]

Backport issue(s) opened: #56437 (for 1.18), #56438 (for 1.19).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/445496 mentions this issue: crypto/x509: respect GODEBUG changes for allowing SHA1 certificates

[gopherbot]

Change https://go.dev/cl/445655 mentions this issue: crypto/x509: respect GODEBUG changes for allowing SHA1 certificates

[gopherbot]

Change https://go.dev/cl/445656 mentions this issue: crypto/x509: respect GODEBUG changes for allowing SHA1 certificates

[gopherbot]

Change https://go.dev/cl/449504 mentions this issue: internal/godebug: define more efficient API