fips builds don't pass forbidden api tests

[nik9000]

Ever since 82d10b4 the forbidden API checks have been failing on the fips builds. It isn't clear if this is a problem with the build or it is revealing a real problem with our fips compliance. I'm assigning to @atorok to investigate because he made the commit that broke the builds. If it turns out that this is a problem with our compliance he'll pass it off to someone who knows more about that stuff.

https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+master+matrix-java-periodic/ES_BUILD_JAVA=java10,ES_RUNTIME_JAVA=java8fips,nodes=virtual&&linux/263/console

[elasticmachine]

Pinging @elastic/es-core-infra

[jkakavas]

:x-pack:plugin:security:cli: is the only module that has a compile and runtime dependency in BouncyCastle ( it was split out of security for that exact reason ).

We already do not run tests in a FIPS JVM,

elasticsearch/x-pack/plugin/security/cli/build.gradle

Lines 23 to 25 in 71d5c66

	if (inFipsJvm) {
	test.enabled = false
	}

so should we also disable forbiddenApi ?

[alpar-t]

Forbidden APIs used to be ran with the JVM running Gradle and I switched to running it with run-time java, which in this case is FIPS. I would like to understand why the forbidden patterns are triggered, maybe we could selectively disable rules instead of disabling it all.