patch: let cmd/go be built statically and still make cgo binaries from that static binary

[bradfitz]

Summary: let us build tailscale/go's cmd/go as a static binary so it runs on NixOS, but then still be able to build cgo binaries with it.
Upstream status: should but haven't.
Importance: required for NixOS users inside the company, including some of our builders
Example prior commit: a2f29de

(Then used in 26292c0, 178d6bc, etc)

cc @danderson

[bradfitz]

ts1.23: 1e42045
ts.124: d186334

[bradfitz]

This patch hasn't been relevant since Go 1.21 which did golang@8a27154 ("Build cmd with CGO_ENABLED=0. ... In particular the Linux versions will run on Alpine and NixOS without needing a simulation of libc.so.6.")

But in Go 1.24 something else changed (TBD) which makes this change actually harmful and break depaware (by breaking x/tools/go/packages) which sets CGO_ENABLED=1 on GOOS=cross-compiled-values. But we only see that breakage when using gocross now, so something in gocross needs adjusting.

/cc @danderson @raggi @awly @icio

[bradfitz]

(label "upstreamed" is a bit of a stretch because we didn't do it, but it's the closest label we've got)