feat(go): support go.mod in Go 1.17+

[knqyf263]

Description

Description

Go 1.17+ adds indirect dependencies to go.mod. This PR parses go.mod as well as go.sum and merges them according to the Go version in go.mod.

• Go 1.17+
  • it takes only go.mod and ignores go.sum.
• Go 1.16 or less
  • it takes direct dependencies in go.mod and indirect dependencies in go.sum.

It reduces unused dependencies as shown below.

Before

$ ./fanal fs --skip-dirs analyzer --skip-dirs artifact --skip-dirs config .
...
gomod (go.sum): 697

After

$ ./fanal fs --skip-dirs analyzer --skip-dirs artifact --skip-dirs config .
...
gomod (go.mod): 164

Related issues

• Close Go module false positives #1973

Related PRs

• Add support for go.mod as well as go.sum go-dep-parser#76
• feat(golang): add support for go.mod fanal#465

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).