Retract incorrectly tagged out-of-order version (v1.2.3) (#398)

* add retract block to go.mod files

This marks the incorrectly tagged version as retracted, which means go
tooling will no longer consider it the latest version (and won't attempt
to automatically upgrade to it).

In addition, once this is merged, we will need to tag v1.2.4:
- this creates a new largest semver version, which go will consider as
  latest
- go tooling will download this v1.2.4 version, read the retract
  statements, then correctly interpret the true latest version to be
  v0.X.Y

This is needed because once a version is added to the sum.golang.org
database, it is never removed (prioritizing build stability). See
https://go.dev/ref/mod#checksum-database, which this change is based
off, for more details.

* tidy

lib/go/contracts/go.mod

@@ -38,3 +38,12 @@ require (
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+// This retraction block retracts version v1.2.3, which was tagged out-of-order.
+// Currently go considers v1.2.3 to be the latest version, due to semver ordering,
+// despite it being several months old and many revisions behind the tip.
+// This retract block is based on https://go.dev/ref/mod#go-mod-file-retract.
+retract (
+	v1.2.4 // contains retraction only
+	v1.2.3 // accidentally published with out-of-order tag
+)

lib/go/templates/go.mod

@@ -50,3 +50,12 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+// This retraction block retracts version v1.2.3, which was tagged out-of-order.
+// Currently go considers v1.2.3 to be the latest version, due to semver ordering,
+// despite it being several months old and many revisions behind the tip.
+// This retract block is based on https://go.dev/ref/mod#go-mod-file-retract.
+retract (
+	v1.2.4 // contains retraction only
+	v1.2.3 // accidentally published with out-of-order tag
+)