add FIPS support to control container

[bcressey]

As part of the overall effort to migrate to AL23 in #73, we should have the control container place itself into "FIPS mode" if the host is running with FIPS enforced.

In this mode, it should also prefer the FIPS endpoints for SSM if available.