Use `go list` instead of `go mod graph` to build dependency graph

`go mod graph` apparently isn't really intended for generating an accurate dependency graph (that is, differentiating between direct and transitive dependencies). This becomes painfully obvious when running that command on modules that have `go 1.17` in their `go.mod` file (https://github.com/golang/go/issues/47648).

The output of `go list -deps -json` has a `.Deps` field which we could use to build a dependency graph instead. But `go list` as of today is still subject to build constraints. That will work for the new `app` command, but not for `mod`.

There is however an effort of supporting "unconstrained" use of `go list`: https://github.com/golang/go/issues/42504

Start by reviewing the existing dependency-graph handling for the app and mod commands, then compare its use of `go mod graph` with the `.Deps` field from `go list -deps -json`. Check the `go 1.17` behavior and the build-constraint limitation described in the issue. Done means the graph differentiates direct and transitive dependencies without breaking either command.

Written by the indexing model from the issue text.