novendor: option to consider all vendored projects source packages for the purpose of determining packages that are used

[nmiyake]

Consider the following example:

vendor/github.com/org/project
  |--> foo
  |--> bar
vendor/github.com/org-2/project-2
  |--> baz

The main project code imports org/project/foo.
org/project/bar imports org-2/project-2/baz.

Currently, if novendor is run in this scenario, org-2/project-2/baz will be reported as unused. Internally, org/project/bar is also considered unused, but because the heuristic indicates that it is part of a "project" (org/project) that is used, it is not reported.

Based on this report, the logical course of action is to remove org-2/project-2. Although this will work, if a command like go build ./... or go install ./... is run, org/project/bar will complain because its dependency (org-2/project-2/baz) is missing.

novendor should provide an option that offers a way out of this scenario without explicit whitelisting. The idea would be that all "projects" that are considered by novendor should also be treated as source roots, and the dependency graphs for those packages should be included in the check.

In the scenario outlined above, running the check in this mode would not report any unused packages.

[nmiyake]

Reverted feature because it was causing performance issues. Should be possible to do in a better manner, but re-opening until that can be done.