go.mod: Support updating non-release git dependencies

Empirically, dependabot only seems to send PRs to update dependencies that have tags in git. I've also got a bunch of dependencies that point at git repos, and I'd like PRs updating them as well! In other languages, git based dependencies appear to get updated.

The issue describes updating Go dependencies that point to non-release Git revisions, but it names no files, tests, or entry points. Start by locating the Go dependency updater and its existing handling of tagged Git dependencies; done means reliably proposing updates for non-release Git dependencies with coverage for the behavior.

Written by the indexing model from the issue text.