feat(manager/gomod): update indirect dependencies for Go Modules

[jamietanna]

Changes

To allow folks to update their indirect dependencies for Go modules, we
can parse them as depType: indirect.

This introduces a new Package.enabled field to allow disabling the
packages, and re-enable packages after the fact.

Closes #19416, #19430.

Context

• Closes Capture indirect dependencies for Go Modules #19416
• Closes Allow updating indirect dependencies for Go Modules #19430

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[rarkins]

I'm not sure we want indirect dependencies to be updated by default? I thought the idea would be to set enabled=false by default so that it's possible to override that using packageRules. And we'd also need to update the docs about that

[jamietanna]

Sorry yeah that was a misinterpretation on my part! I've updated to add that back 👍

[rarkins]

Just to clarify (because it's not easy to understand), enabled can be overridden by packageRules, but skipReason cannot

[jamietanna]

Good to know, thanks! Do I need to change skipReason, now we're supporting this, or is it OK to leave it in?

[rarkins]

Also needs an update to the gomod readme to explain:

• indirect dependencies aren't updated by default
• how to re-enable them to using a package rule, to get updates

[jamietanna]

Thanks for helping get this over the line 🙌

[renovate-release]

🎉 This PR is included in version 34.58.0 🎉

The release is available on:

• GitHub release
• 34.58.0

Your semantic-release bot 📦🚀