Create "lockfile" for Go

Go go.mod and go.sum may not tell the actual correct story.
Beyond the binary analysis of go-inspector, there may be ways to get more accurate details
See
- https://stackoverflow.com/questions/78222209/go-mod-graph-doesnt-seem-to-provide-the-full-graph
- https://stackoverflow.com/questions/70128040/content-of-go-sum-and-modules-really-used-by-a-go-application