Detect more unpinned golang commands

[laurentsimon]

There are several commands https://go.dev/ref/mod that update the go.mod/go.sum and may patch the sum file.

We should detect them in the Pinned-Dependencies check.

[laurentsimon]

other examples go test -mod=vendor

[laurentsimon]

Note that a command such as go install [email protected] may be considered pinned, because of the logs used to cache packages. However, this would not updated by tools like renovatebot / dependabot because they cannot parse commands, so we may still want to discourage this practice.

[github-actions[bot]]

This issue is stale because it has been open for 60 days with no activity.

[github-actions[bot]]

This issue has been marked stale because it has been open for 60 days with no activity.