It's not officially in any federal law. And even if it does, state law still overrides it. You are mistaken that federal law supersedes state law. That's what the 10th amendment is all about. Most people don't realize that the states have way more authority in this country.

As far as your question goes as to what has officially been released:

Biden gave an EO on Sep 9th. The EO states that there will be a task force established ("Safer Federal Workforce") that will work on establishing "guidance". It then directs federal agencies to put contractual language requiring the contractor to comply with the Safer Federal Workforce Guidance. The EO can be found: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/09/09/executive-order-on-ensuring-adequate-covid-safety-protocols-for-federal-contractors/

Safer Federal Workforce Guidance put out guidance basically saying all contractors needed to be fully vaccinated by Dec 8th: https://www.saferfederalworkforce.gov/downloads/Draft%20contractor%20guidance%20doc_20210922.pdf

The "guidance" states it overrides state law, but that is in direct conflict with the 10th amendment which gives this authority to State Law.

It'll be challenged in the courts, but the problem is since its not technically law it can't be brought to court. It'll probably happen when the clauses come out and companies start suing the federal government.