Figure out why GoReleaser builds needs -buildid= added to ldflags for reproducible builds on GitHub Actions

NOTE: Originally reported on Jan 23, 2020 in https://github.com/oasislabs/goreleaser/issues/1.

The fix for golang/go#33772, i.e. to no longer require to run go build with -ldflags=-buildid= set, has been backported to Go 1.13 (golang/go#34326) and is included in the Go 1.13.4 release.

However, when building the oasis-node binary in Oasis Core using GoReleaser via GitHub Actions returns different results depending on the path where the Oasis Core git repository is checked out, unless -buildid= is added to ldflags.

On the other hand, building the oasis-node binary directly via Make's go build invocation works regardless of the path where the Oasis Core git repository is checked out (and without needing -buildid= added to ldflags).

Here is an example GitHub Actions workflow run that demonstrates this issue:

The GoReleaser binaries built from different git paths only differ in:

• .note.go.buildid
• .note.gnu.build-id

as was discovered in https://github.com/oasislabs/oasis-core/issues/2571#issuecomment-576693517.

Start by comparing the GoReleaser GitHub Actions workflow with Oasis Core's Make-based go build invocation, using the linked workflow run as the reproduction. Check why builds from different checkout paths differ in .note.go.buildid and .note.gnu.build-id; done means the cause is identified and the reproducibility behavior is documented or corrected.