consider GitHub repositories where the Go module isn't at the root

[mvdan]

We use GitHub's GraphQL API, which is great for querying 100 repositories at a time while getting the contents of HEAD:go.mod at the same time. This is great because it lets us do the work we need in fewer API calls. GitHub limits API calls to 5k/hr, so one extra API call per repository would be very limiting.

This brings us a problem, though - HEAD:go.mod simply looks for the go.mod file in the root directory of the default branch. If a repository has the go.mod file elsewhere, such as pkg/go.mod or projectname/go.mod, we won't find it and we'll discard the repository as not being a Go module.

The solution might be to do an extra API call to do a file search for go.mod files in the repositories which do not contain a root go.mod file. If that results in exactly one go.mod file and it's not part of a vendored module, we use it. This might be okay, given that only a small portion of Go repositories lack a root go.mod file.