cmd/go: go build -mod=readonly should disallow go.sum updates

[rsc]

go build -mod=readonly disallows go.mod updates.
It should also disallow go.sum updates.
Maybe it already does; I haven't checked.

[marwan-at-work]

can confirm that -mod=readonly does not disallow go.sum updates.

go mod init reproduce 
go get github.com/pkg/errors
echo "" > go.sum
go build -mod=readonly

[gopherbot]

Change https://golang.org/cl/166237 mentions this issue: cmd/go: disallow go.sum updates in -mod=readonly