better support for multiple go.mod files

In [soci-snapshotter](https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/packages/soci-snapshotter/Cargo.toml#L17) we have an example of a project with multiple `go.mod` files.

The way this is currently implemented in `buildsys`, we end up making two passes over the same unpacked external file, which is inefficient. Listing the same file twice is also not an obvious approach to packagers.

Fixing this might entail taking a list of paths in `bundle-root-path` instead of just one.

Start with packages/soci-snapshotter/Cargo.toml#L17 to understand the multiple-go.mod example, then trace how buildsys handles bundle-root-path and unpacked external files. Done means one external file is not processed twice and packagers can express multiple paths without listing the same file twice.

Written by the indexing model from the issue text.