feat(ci): FIPS base image for EE/FIPS Docker builds (release-5.12)

Gromit-generated output:
- Dockerfile.distroless: parameterized with BASE_IMAGE ARG for
  per-build Docker base image override
- goreleaser.yml: added FIPS builds (amd64, arm64, s390x) using
  GOFIPS140=v1.0.0 (Go 1.24+ native FIPS 140-3 module)
- release.yml: added FIPS Docker build steps, BASE_IMAGE build-arg
  on EE builds, Go 1.25 build environment

EE and FIPS Docker images use tykio/dhi-busybox:1.37-fips (hardened).
OSS (std) images use default distroless base (unchanged).
Docker images: amd64/arm64 for EE/FIPS, amd64/arm64/s390x for OSS.
Packages: all three archs for all variants.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: buger