fix: update TestConnectionTLS for native Go FIPS

Add verification_mode:strict so Go's native TLS stack performs chain
verification (InsecureSkipVerify=false) and the FIPS key-size check
triggers. Update the expected error string to match native Go's message.
Simplify the test comment to remove implementation details.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: macdewee

libbeat/esleg/eslegclient/connection_test.go

@@ -240,22 +240,17 @@ func BenchmarkExecHTTPRequest(b *testing.B) {
 	}
 }
 
-// TestConnectionTLS tries to connect to a test HTTPS server (pretending
-// to be an Elasticsearch cluster), that deliberately presents TLS options
-// that are not FIPS-compliant.
-// - If the test is running with a FIPS-capable build, the client, being FIPS-
-// capable, should fail the TLS handshake. Concretely, the conn.Connect() method
-// should return an error.
-// - If the test is not running with a FIPS-capable build, the client should
-// complete the TLS handshake successfully. Concretely, the conn.Connect() method
-// should not return an error.
+// TestConnectionTLS connects to a test HTTPS server that presents a 1024-bit
+// RSA certificate, which is below the FIPS 140-3 minimum of 2048 bits.
+// In a FIPS build the handshake must fail; in a non-FIPS build it must succeed.
 func TestConnectionTLS(t *testing.T) {
 	server := startTLSServer(t)
 	defer server.Close()
 
 	transportSettings := `
 ssl:
   enabled: true
+  verification_mode: strict
 `
 
 	var transport httpcommon.HTTPTransportSettings
@@ -276,7 +271,7 @@ ssl:
 	err = conn.Connect(ctx)
 
 	if version.FIPSDistribution {
-		require.ErrorContains(t, err, "tls: internal error")
+		require.ErrorContains(t, err, "tls: no FIPS compatible certificate chains found")
 	} else {
 		require.NoError(t, err)
 	}