fix(fips): unified module validation with version-gated artifact checks

[smith-xyz]

Replace separate artifact and host lib checks with unified per-module
ValidateModule that tries RPM + version range + file gate, then falls
back to host lib FIPS symbols. Adds certified_artifact_max_version to
scope entries to specific release lines (e.g. openssl-libs 1.1.1 for
RHEL 8). Config now declares all CMVP-certified modules explicitly.

Supports Go native FIPS via artifact_source="binary" with config-driven
minimum version for GOFIPS140 build setting.

Fixes: #332

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@smith-xyz: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[smith-xyz]

tested on all nightlies - passed:

registry.ci.openshift.org/ocp/release:4.12.0-0.nightly-2026-05-06-095208
registry.ci.openshift.org/ocp/release:4.13.0-0.nightly-2026-05-11-192047
registry.ci.openshift.org/ocp/release:4.14.0-0.nightly-2026-05-07-213817
registry.ci.openshift.org/ocp/release:4.15.0-0.nightly-2026-05-06-215654
registry.ci.openshift.org/ocp/release:4.16.0-0.nightly-2026-05-14-021554
registry.ci.openshift.org/ocp/release:4.17.0-0.nightly-2026-05-14-020539
registry.ci.openshift.org/ocp/release:4.18.0-0.nightly-2026-05-13-164455
registry.ci.openshift.org/ocp/release:4.19.0-0.nightly-2026-05-13-043200
registry.ci.openshift.org/ocp/release:4.20.0-0.nightly-2026-05-13-153530
registry.ci.openshift.org/ocp/release:4.21.0-0.nightly-2026-05-12-052734
registry.ci.openshift.org/ocp/release:4.22.0-0.nightly-2026-05-13-154759
registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-05-12-025124

[richardsonnick]

/lgtm