x/pkgsite: support viewing a module at a specific git commit

[mvdan]

As far as I can tell, pkgsite supports viewing a package at three versions via https://pkg.go.dev/some-module@some-version:

• The default, @latest
• @master, which works on git as the "latest development" branch of many git repos
• Specific Go module versions, like @v1.2.3 or v3.4.0-0.dev.0.20210826165642-ec61336f424e

go list -m some-module@some-version supports all three, plus any version known to the VCS repository. For example:

$ go list -m mvdan.cc/sh/v3@ec61336f4 # short git commit
mvdan.cc/sh/v3 v3.4.0-0.dev.0.20210826165642-ec61336f424e
$ go list -m mvdan.cc/sh/v3@fuzz-corpus # git branch
mvdan.cc/sh/v3 v3.4.0-0.dev.0.20210523164001-ed686c72b3ae

I'm running with the default GOPROXY and an empty GOPRIVATE, and it seems like these simply go via proxy.golang.org:

• https://proxy.golang.org/mvdan.cc/sh/v3/@v/fuzz-corpus.info
• https://proxy.golang.org/mvdan.cc/sh/v3/@v/ec61336f4.info

The feature request for arbitrary branches is already at #46914. This issue is about the other scenario: specific commits from the VCS. The main difference with branches is that, by definition, branches are a moving target. Specific commits are more like tags: they should generally be treated as immutable once published.

My particular use case today is similar to arbitrary branches; imagine I've pushed a new feature to a feature branch in the upstream git repo, and I want to check that pkgsite renders it well and the docs make sense. I might also want to share the link as part of a PR to allow easier review.

Right now I can do it manually via this monstrosity of a hack:

$ firefox "https://pkg.go.dev/github.com/ipld/go-ipld-prime@$(go list -m -f {{.Version}} github.com/ipld/go-ipld-prime@eba8e5653ba2e418866c0c51b292e7bd4e9c080b)"

Essentially, using go list -m to turn a git commit into the Go pseudo-version, then using that as the version suffix in the pkgsite URL.

It would be much better UX if pkgsite did this for me, just like go list -m does, and especially seeing how the proxy server already has the support.