cmd/go: automatically tidy go.sum

[rsc]

Now that we can authenticate new entries in go.sum,
there is less concern about keeping old ones around
that are not part of the current module graph.
If we update go.mod from v0.1.0 to v0.2.0 of a module
and v0.1.0 is no longer referenced in the build graph,
we should probably drop v0.1.0 from the go.sum.

Not sure about Go 1.13 vs Go 1.14.
Depends on how much work it is.

[rsc]

/cc @bcmills @jayconrod

[bcmills]

Given that we're in the code freeze, and that over-retaining checksums doesn't seem to cause any significant harm in the short term, I think this belongs in 1.14 regardless of size.

[matloob]

Closing this issue: -mod=readonly has been the default since Go 1.16 and the expected workflow is that users explicitly run commands like go get and go mod tidy to modify their go.mod and go.sum files.