proposal: cmd/go: add GOSUMDBDIR to configure the location of downloaded checksum database files

[bcmills]

Over many years we've been trying to move to a state in which GOPATH/pkg is no longer needed (#4719, #34527).

However, it appears that when we added support for the checksum database (#25530), we did not also add a configuration point for the location of the local copy of the checksum database and transparency log. It is currently always located in GOPATH/pkg/sumdb:
https://cs.opensource.google/go/go/+/master:src/cmd/go/internal/cfg/cfg.go;l=422;drc=8fce59eab5cb2facfafca89e047b4b43ba44785f

For consistency, I think we should add such a configuration point as an environment variable akin to GOMODCACHE.

I suggest either GOSUMDBDIR (analogous to GOTMPDIR) or GOSUMDBCACHE (analogous to GOMODCACHE).

(CC @rsc @matloob @golang/tools-team)

[mvdan]

Can we not store this inside GOMODCACHE? It is cached information that was fetched about Go modules, after all. I'm not sure that users will see a benefit in keeping the directories and env vars separate.

[bcmills]

It isn't in GOMODCACHE today.

There is a moderate security benefit from not clearing the transparency log when one runs go clean -modcache, but I suspect that if we just special-cased “don't clear the tree head” that would probably be fine. 🤷‍♂️

[mvdan]

I understand the directories aren't merged today - I mean to say that we could join them and sidestep the need for GOSUMDBCACHE :) Go already has two "cache" env vars, which many users are confused by, so I'd love to avoid a third. Nearly as much as I'd love to get rid of my GOPATH directory.