Add support for go packages in manifest files

[TG1999]

This PR adds support for go packages in manifest files.
Go uses multiple styles to reference packages/modules and their versions:

Packages

• A) in Go code, we can import "packages" as in https://github.com/moby/moby/blob/6c10086976d07d4746e03dcfd188972a2f07e1c9/registry/auth.go ... there is no version there and this requires parsing the Go source code. This is not in the scope of this PR.

A package is a directory with a bunch of go files, and is further declared in the code of this package itself with "package foo" directives.

We cannot infer a PURL from a package only: we are missing the version and we do not know where the path or name of the modules ends.

Modules

A module is a collection of packages with a go.mod file at the root.

• C) in go.mod we have "module nameminimum version" as in https://github.com/moby/moby/blob/6c10086976d07d4746e03dcfd188972a2f07e1c9/vendor.mod#L125 . This requires parsing the mod file as done elsewhere, like in the ScanCode toolkit.

• D) in go.sum we have with an extra checksum as in https://github.com/moby/moby/blob/6c10086976d07d4746e03dcfd188972a2f07e1c9/vendor.sum . This requires parsing the sum file as done elsewhere, like in the ScanCode toolkit.

• E) when running the go command line we can run go get github.com/foo/foo-package@31c913b to fetch a specific version of a module/package in the workspace. The version after the @ sign is the go module version, and the name before is the module/package path (github.com/foo/foo-package). We cannot infer the module unless we query the go proxy.

Modules can have a PURL and have a version (at least we know either the pinned or minimum version from the mod or sum file).

A) and E) are not in scope here, because we cannot reliably infer a module from a package short of doing extra calls. This is best done elsewhere, for instance in fetchcode.

B) and C) are in scope and the input is that of a go.mod for now. Dealing with checksums is something different that should be handled elsewhere possibly in Scancode like in https://github.com/nexB/scancode-toolkit/blob/66d71661f5ede54cb0f3b36d7663c92a67030299/src/packagedcode/go_mod.py#L206

[pombredanne]

Just a minor nit to add more docs. Please merge!