patch: let cmd/go be built statically and still make cgo binaries from that static binary

[bradfitz]

Summary: let us build tailscale/go's cmd/go as a static binary so it runs on NixOS, but then still be able to build cgo binaries with it. Upstream status: should but haven't. Importance: required for NixOS users inside the company, including some of our builders Example prior commit: a2f29de0a91a04521eaef084ab7eefd319d4fbbe

(Then used in 26292c0a2e9823c4216e8776912a43fd9e50d444, 178d6bce616ceefcdd687341cb74d7d8868877a7, etc)

cc @danderson

[bradfitz]

ts1.23: 1e420458c58b6ab70903a236f1cf015411036b6a ts.124: d186334735546491adfacc603a2ca183dca7df0

[bradfitz]

This patch hasn't been relevant since Go 1.21 which did https://github.com/golang/go/commit/8a27154bcdb657fd172e77ba19ac0a5dccb996fb ("Build cmd with CGO_ENABLED=0. ... In particular the Linux versions will run on Alpine and NixOS without needing a simulation of libc.so.6.")

But in Go 1.24 something else changed (TBD) which makes this change actually harmful and break depaware (by breaking x/tools/go/packages) which sets CGO_ENABLED=1 on GOOS=cross-compiled-values. But we only see that breakage when using gocross now, so something in gocross needs adjusting.

/cc @danderson @raggi @awly @icio

[bradfitz]

(label "upstreamed" is a bit of a stretch because we didn't do it, but it's the closest label we've got)