Support Go module graph

[pombredanne]

See https://go.dev/ref/mod#go-mod-graph

[arbazkhan971]

I'd like to take this.

Plan: parse the go mod graph text format (spec) as a package datafile, the same way Swift/pip DepLock dumps are handled:

• recognize go-mod-graph.deplock and go.mod.graph
• treat the first requiring module as the main module
• collect unique required modules, marking those required by the main module as direct and the rest as transitive
• versions in the graph are the selected versions, so they are pinned

I'll open a PR from develop.