Add go.mod checks to the CI

**What would you like to be added**:

Currently its possible to add new dependencies as import statments in source files but accidentally leave them out of a go.mod. We should add protection that blocks PRs from merge if the go.mod isn't synchronized.

**Why is this needed**:

Reproducible builds provide various guarantees. At a high level they ensure we have no surprises that may break the build unexpectedly. Without a version stamped into go.mod/go.sum builds fall short of reproducible.

**Proposal**:

Add a CI job that checks, on build, if the go.mod has a diff (or some other mechanism that results in deps being added to go.mod). If the go.mod has a diff it means the developer never ran `go get` and the dep isn't fixed.

Start by locating the repository's existing CI build entry points and review how go.mod and go.sum are handled during builds. Add a CI check that detects an unsynchronized go.mod, using the proposed dependency-resolution flow as the reference, and confirm that a dependency omitted from go.mod causes the check to block merging.

Written by the indexing model from the issue text.