Implement environment-based FIPS mode configuration

[straistaru]

Summary

The service can already run in FIPS mode: it checks that OpenSSL is ready for FIPS and drops the two connectors that need NTLM (network drive and SharePoint Server). But that code lives in service_cli.py, which the agent does not use. The agent starts the service through connectors/agent/, and nothing there knows about FIPS.

We need it on elastic-agent for the new elastic-agent-service-fips image.

What this changes

• connectors/fips.py: new apply_fips_mode(config). Sets the mode, checks OpenSSL, drops the connectors that cannot run under FIPS. Both service_cli.py and connectors/agent/service_manager.py call it, so the rule lives in one place.
• The setting comes from ELASTICSEARCH_CONNECTORS_FIPS_MODE, because there is no config file on Agent and Agent does not report FIPS mode.
• Only true and false are accepted. A typo like ture stops the service instead of quietly turning FIPS mode off. Unset still means off.
• The mode is always logged at start: FIPS mode is enabled or FIPS mode is disabled.
• If FIPS mode is on but OpenSSL is not ready, the component now exits with code 1. Before, MultiService hid the error and it exited 0. This applies to any error that kills the service, not just FIPS.

Nothing changes when FIPS mode is off. All 31 connectors stay available.

Checklists

Pre-Review Checklist

• this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check config.yml.example)
• this PR has a meaningful title
• this PR links to all relevant github issues that it fixes or partially addresses
• if there is no GH issue, please create it. Each PR should have a link to an issue
• this PR has a thorough description
• Covered the changes with automated tests
• Tested the changes locally
• Added a label for each target release version (example: v7.13.2, v7.14.0, v8.0.0)
• For bugfixes: backport safely to all minor branches still receiving patch releases
• Considered corresponding documentation changes
• Contributed any configuration settings changes to the configuration reference
• if you added or changed Rich Configurable Fields for a Native Connector, you made a corresponding PR in Kibana

Changes Requiring Extra Attention

• Security-related changes (encryption, TLS, SSRF, etc)
• New external service dependencies added.

Related Pull Requests

Release Note