feat(license): scan vendor directory for license for go.mod files

[oneum20]

Description

This PR adds support for scanning the vendor directory when detecting licenses for Go modules. Currently, Trivy only checks for licenses in $GOPATH/pkg/mod, but when users use go mod vendor command, the dependencies are stored in the vendor directory without their own go.mod files.

Related issues

• ISSUES - 8527

Checklist

• [x] I've read the guidelines for contributing to this repository.
• [x] I've followed the conventions in the PR title.
• [x] I've added tests that prove my fix is effective or that my feature works.
• [ ] I've updated the documentation with the relevant information (if needed).
• [ ] I've added usage information (if the PR introduces new options)
• [ ] I've included a "before" and "after" example to the description (if the PR is a user interface change).

[oneum20]

Hi @DmitriyLewen!

Thanks for your review! I've addressed the feedback and updated the code accordingly. Could you please take another look when you have a moment?

Thanks!

[DmitriyLewen]

@oneum20 I refactored a bit, can you take a look and confirm that i didn't break your logic? 😄

[oneum20]

@DmitriyLewen Thanks for the refactor! Everything looks fine on my end. 😃

[DmitriyLewen]

Hello @oneum20 Do you have time to resolve conflict?

If no - tell me, i will do that.

[oneum20]

Hi @DmitriyLewen, I’ve tried resolving the conflicts. 😄

[knqyf263]

I found that this test doesn't respect the vendor dir as it is not added to mapfs. It just reads a license file from GOPATH. I'll fix it in another PR.