Investigate using different Go sum database & Go source references for builds

**What I'd like:**

Similar to bottlerocket-os/bottlerocket#432, let's investigate what it looks like to use a different `GOSUMDB` and `GOPROXY` to enable a different Go source "of truth" in our Go builds. Right now, we pull directly from source which is fine but may be nasty if GitHub is down and we can't vendor Go code:

https://github.com/bottlerocket-os/bottlerocket/blob/d04eaa730285cf32430c3897bf33b4593042242c/macros/shared#L184-L185

Start with the referenced Bottlerocket macros/shared lines 184–185 and trace how the corresponding Go build configuration is represented in twoliter. Investigate the effects of alternate GOSUMDB and GOPROXY settings, then document a concrete recommendation or implementation scope for using a different Go source of truth.

Written by the indexing model from the issue text.