secureenclave: remove deprecated crypto APIs, bump to go 1.26.5

[brhoades]

We previously noted that a few crypto APIs were deprecated, even back in #37 we added lint excludes. I don't believe there was a way around it at the time for ecdsa, though? Go 1.26 further deprecated the ecdsa.PublicKey fields for X and Y after 1.25 added ecdsa.ParseUncompressedPublicKey, per the changelog:

The new ParseRawPrivateKey, ParseUncompressedPublicKey, PrivateKey.Bytes, and PublicKey.Bytes functions and methods implement low-level encodings, replacing the need to use crypto/elliptic or math/big functions and methods.

I'm no cryptographer, but this looks like what's required to remove our deprecated usage, since we can now directly parse a public key from some bytes. It also ended up being a roadblock when upgrading actionlint.

Changes:

• Swapped out /pkg/secureenclave's to use the new APIs described above.
• Added docs about working around openssl errors on MacOS.

TPM Error

I added documentation about openssl after running into this error on TPM tests:

❯ go test -v -count 1 ./pkg/tpm
# github.com/google/go-tpm-tools/simulator/internal
In file included from ../../go/pkg/mod/github.com/google/go-tpm-tools@v0.3.11/simulator/internal/internal_cgo.go:45:
In file included from ../../go/pkg/mod/github.com/google/go-tpm-tools@v0.3.11/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/Tpm.h:47:
In file included from ../../go/pkg/mod/github.com/google/go-tpm-tools@v0.3.11/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/LibSupport.h:63:
../../go/pkg/mod/github.com/google/go-tpm-tools@v0.3.11/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/Ossl/TpmToOsslSym.h:47:10: fatal error: 'openssl/aes.h' file not found
   47 | #include <openssl/aes.h>
      |          ^~~~~~~~~~~~~~~
1 error generated.
FAIL	github.com/kolide/krypto/pkg/tpm [build failed]
FAIL

Test Results

Running the secureenclave tests pass:

=== RUN   TestSecureEnclaveTestRunner
=== PAUSE TestSecureEnclaveTestRunner
=== CONT  TestSecureEnclaveTestRunner
    secureenclave_test.go:39: 
        executing wrapped tests with codesigned app and entitlements
    secureenclave_test.go:73: === RUN   TestPublicKeyKnownGood
        === PAUSE TestPublicKeyKnownGood
        === RUN   TestPublicKeyLookUpHashNilCoordinates
        === PAUSE TestPublicKeyLookUpHashNilCoordinates
        === RUN   TestSecureEnclaveTestRunner
        === PAUSE TestSecureEnclaveTestRunner
        === RUN   TestSecureEnclaveSigning
        === PAUSE TestSecureEnclaveSigning
        === RUN   TestSecureEnclaveErrors
        === PAUSE TestSecureEnclaveErrors
        === CONT  TestPublicKeyKnownGood
        === CONT  TestSecureEnclaveErrors
        === CONT  TestSecureEnclaveSigning
        === CONT  TestPublicKeyLookUpHashNilCoordinates
        === NAME  TestSecureEnclaveErrors
            secureenclave_test.go:115: 
                running wrapped tests with codesigned app and entitlements
        === CONT  TestSecureEnclaveTestRunner
        --- PASS: TestSecureEnclaveErrors (0.00s)
        === NAME  TestSecureEnclaveSigning
            secureenclave_test.go:83: 
                running wrapped tests with codesigned app and entitlements
        === NAME  TestSecureEnclaveTestRunner
            secureenclave_test.go:36: 
                skipping because SECURE_ENCLAVE_TEST_WRAPPED env var was not empty, this is the execution of the codesigned app with entitlements
        --- SKIP: TestSecureEnclaveTestRunner (0.00s)
        --- PASS: TestPublicKeyLookUpHashNilCoordinates (0.00s)
        --- PASS: TestPublicKeyKnownGood (0.00s)
        --- PASS: TestSecureEnclaveSigning (0.03s)
        PASS
        coverage: 84.5% of statements
        
--- PASS: TestSecureEnclaveTestRunner (7.32s)
PASS
ok  	github.com/kolide/krypto/pkg/secureenclave	(cached)

[brhoades]

I don't know if we need this. The comment here is true, but whether it can actually happen outside of a test? 🤷

[RebeccaMahany]

I don't think I know the answer to this either. I don't believe I've seen the public key has nil XY coordinates error in logs before, and I'm not seeing it in an extremely cursory search of Cloud Log

[RebeccaMahany]

I don't think I know the answer to this either. I don't believe I've seen the public key has nil XY coordinates error in logs before, and I'm not seeing it in an extremely cursory search of Cloud Log