Per-package go.mod

Hi !

Would it be possible to have one go.mod / go.sum for each package ?

I use the `hmetrics` package in my app. `hmetrics` doesn't need dependencies aside from the standard lib.
However, using `hmetrics` in my app comes with the cost of installing 50+ dependencies from `heroku/x`'s go.mod.

This is heavy and raises useless security alerts (e.g. `heroku/x` depends on `cobra@v1` which depends on `viper@v1` which depends on `dgrijalva/jwt-go@v3` which is deprecated and has CVE-2020-26160).

Thanks!

Start by reviewing the repository's package layout and the root go.mod dependency graph, then inspect how the hmetrics package is consumed. Determine the module boundaries and verify that package-specific go.mod and go.sum files avoid pulling unrelated heroku/x dependencies without breaking package builds or tests.

Written by the indexing model from the issue text.