Add option to run go mod tidy for upstream projects where go.sum is out of sync

[jfkw]

Some upstream Go projects can have a committed go.mod and go.sum where go.sum is out of sync with missing our outdated entries. Running go mod tidy can often fix these errors.

The best mitigation is to get the go.sum update into the upstream repository and ask for a new tagged release.

obs-service-go_modules will consider an experimental argument to the service to run go mod tidy before go mod vendor to preserve the ability to update and build independently of upstream fixing go.sum in a tagged release.

Running go mod tidy will not be on by default. The capability will not initially be designated as stable API and could be removed in a future release.