disable tls kyber KEX

[jbardin]

Disable kyber globally in core. This primarily affects the S3 backend, since the only reported incompatible system was the AWS firewall, and the AWS provider has chosen to disable this option as well. hashicorp/terraform-provider-aws#41740.

There could be other incompatible networks out there still however, and since the X25519Kyber768Draft00 was removed in go1.24, we can just disable it for v1.11 and move on.

Target Release

v1.11

[jar-b]

LGTM 🚀

[jbardin]

This may also require a toolchain directive to not throw off dependabot, but that also means it's another place to track the go version so I don't want to add it yet if we don't have to.

[yovko]

Unfortunately, Go 1.24 removed X25519Kyber768Draft00 but also the tlskyber setting. See https://tip.golang.org/doc/godebug#go-124

Using godebug tlskyber=0 causes a compilation error with Go 1.24.x. See hashicorp/terraform-provider-aws#41898

[jbardin]

@yovko, yes we are aware. This branch is only built from go1.23 however, which uses this flag.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.