When a vendor directory is present, we must explicitly use -mod=readonly
to query upgrades with `go list`. This was broken by the fixes for
workspace vendoring, which removed the `-mod` flag in most usage of the
gocommand package.

Fixes golang/go#66055

Change-Id: I29efb617a8fe56e9752dc088dc5ea884f1cefb86
Reviewed-on: https://go-review.googlesource.com/c/tools/+/569877
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Alan Donovan <adonovan@google.com>