better support for multiple go.mod files

[bcressey]

In soci-snapshotter we have an example of a project with multiple go.mod files.

The way this is currently implemented in buildsys, we end up making two passes over the same unpacked external file, which is inefficient. Listing the same file twice is also not an obvious approach to packagers.

Fixing this might entail taking a list of paths in bundle-root-path instead of just one.