Create "lockfile" for Go

[pombredanne]

Go go.mod and go.sum may not tell the actual correct story.
Beyond the binary analysis of go-inspector, there may be ways to get more accurate details
See

• https://stackoverflow.com/questions/78222209/go-mod-graph-doesnt-seem-to-provide-the-full-graph
• https://stackoverflow.com/questions/70128040/content-of-go-sum-and-modules-really-used-by-a-go-application

[anant-shipit]

Hi @pombredanne
I'm a Go backend developer and I would love to take this issue on.
I completely agree that parsing go.mod and go.sum manually is brittle and misses the true graph (especially with module pruning in newer Go versions).
My approach would be to create cmd/go.go and leverage the native toolchain (e.g., executing go list -m -json all or go mod graph via os/exec), capturing the stdout, and parsing the exact, resolved dependency graph into the standardized lockfile format expected by the inspector.
Could you assign this to me? I can get started on the parser structure right away!