Gosum support

[alessandro-Doyensec]

This PR enables scalibr to search for indirect dependencies inside the go.sum if the go.mod's golang version is < 1.17.

This feature is necessary since before 1.17 every indirect dependency was only present in the go.sum file.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[alessandro-Doyensec]

Hey @vpasdf , while refactoring, I was thinking about some potential ways to merge the go.mod and go.sum dependencies. I had the idea to just append the go.sum location if a dependency was already found inside the go.mod.

You can check out the implementation in the last commit. If you'd rather keep the dependencies separated, I can roll back this change. Let me know your thoughts!