Use `go tool` in Makefile

We use `go tool` to run `shfmt`, `go-licenses`, etc. in CI, but in the Makefile we run whatever version is installed locally on the `PATH`.

Shouldn't we always use the same mechanism?

Also is there a reason not to run other tools, like `golangci-lint` via `go tool` as well?

And if we use `go tool` everywhere in the `Makefile`, shouldn't we use `make` in CI instead of hard-coding the lint commands?