[9.1](backport #5088) [FIPS] Test that ES client will not connect to ES with invalid TLS certificate

[mergify]

What is the problem this PR solves?

This PR ensures that any connections made by a FIPS-capable Fleet Server to Elasticsearch will only succeed if Elasticsearch is also FIPS-capable.

How does this PR solve the problem?

This PR adds a new test, TestConnectionTLS, that fakes an Elasticsearch HTTPS server that returns a TLS certificate that's been created with a key length of < 2048 bits, making it invalid for FIPS-compliant use.

If running in FIPS mode, the test asserts that Fleet Server's connection to Elasticsearch will fail with a TLS error.
If not running in FIPS mode, the test asserts that Fleet Server's connection to Elasticsearch will succeed.

How to test this PR locally

In a non-FIPS environment:

$ go test ./internal/pkg/es/... -v -test.run TestConnectionTLS -test.count 1
=== RUN   TestConnectionTLS
--- PASS: TestConnectionTLS (0.00s)
PASS
ok  	github.com/elastic/fleet-server/v7/internal/pkg/es	0.389s

In a FIPS environment, i.e. with the Microsoft Go fork installed and with the OpenSSL FIPS provider installed:

$ GOEXPERIMENT=systemcrypto go test --tags=requirefips ./internal/pkg/es/... -v -test.run TestConnectionTLS -test.count 1
=== RUN   TestConnectionTLS
2025/07/03 15:46:02 http: TLS handshake error from 127.0.0.1:52214: tls: failed to sign handshake: EVP_PKEY_sign_init failed
openssl error(s):
error:1C800069:Provider routines::invalid key length
	providers/common/securitycheck.c:65
--- PASS: TestConnectionTLS (0.00s)
PASS
ok  	github.com/elastic/fleet-server/v7/internal/pkg/es	0.022s

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool

Related issues

---

This is an automatic backport of pull request #5088 done by [Mergify](https://mergify.com).

[prodsecmachine]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube