cmd/go: go list of stdlib packages that depend on vendored packages downloads, doesn't work

[heschi]

It's a weird thing to do, but I figured I'd note it for the record.

If for some reason you do go list on a vendored package in the stdlib, the upstream version gets downloaded, and of course doesn't work:

GOPATH=$(pwd)/gopath GO111MODULE=on go list cmd/vendor/github.com/google/pprof/internal/plugin
go: finding github.com/google/pprof/profile latest
go: finding github.com/google/pprof latest
go: downloading github.com/google/pprof v0.0.0-20181022170640-baeddb81b1fb
can't load package: $GOROOT/src/cmd/vendor/github.com/google/pprof/internal/plugin/plugin.go:24:2: non-standard import "github.com/google/pprof/profile" in standard package "cmd/vendor/github.com/google/pprof/internal/plugin"

I'm not sure what I was expecting, probably some kind of error, but downloading the upstream version was surprising.

[heschi]

Actually, it's worse than that -- it downloads them even if they're just dependencies:

GOPATH=$(mktemp -d) go list -- runtime/pprof net/http/pprof cmd/pprof .               
go: finding github.com/google/pprof v0.0.0-20181025074646-b44fece90146
go: finding github.com/ianlancetaylor/demangle v0.0.0-20180714043527-fcd258a6f0b4
go: finding golang.org/x/sys v0.0.0-20181025063200-d989b31c8746
go: finding golang.org/x/arch v0.0.0-20180920145803-b19384d3c130
go: finding golang.org/x/crypto v0.0.0-20181025213731-e84da0312774
go: downloading golang.org/x/crypto v0.0.0-20181025213731-e84da0312774
go: downloading golang.org/x/arch v0.0.0-20180920145803-b19384d3c130
go: downloading github.com/google/pprof v0.0.0-20181025074646-b44fece90146
go: downloading golang.org/x/sys v0.0.0-20181025063200-d989b31c8746
go: downloading github.com/ianlancetaylor/demangle v0.0.0-20180714043527-fcd258a6f0b4
can't load package: /usr/lib/google-golang/src/cmd/pprof/pprof.go:28:2: non-standard import "github.com/google/pprof/driver" in standard package "cmd/pprof"
runtime/pprof
net/http/pprof
testmod

[bcmills]

Same underlying problem as #26924, I believe.