feat: Add Go module (go.mod + go.sum) parser

[Copilot]

Adds first-class Go project support to the SBOM library, enabling dependency extraction from go.mod and checksum resolution from go.sum.

New: src/packages/go

• Line-oriented go.mod parser: module, go version, multi-line require (...) blocks, single-line require, // indirect annotations
• go.sum parser: extracts h1: checksums keyed by module@version, skips /go.mod-only entries
• Module path splitting into namespace/name for correct PURL generation (e.g. github.com/google/uuid → pkg:golang/github.com/google/uuid@v1.3.0)

Updated: src/lib

• New scan_go(root_path, go_mod_content, go_sum_content?) public API
• scan_all / parse_discovered_project now handles ProjectType::Go — reads go.mod + optional go.sum from the virtual filesystem

Usage

let project = scan_go(
  "myservice/",
  go_mod_content,
  Some(go_sum_content),
)
let spdx_json = project_to_spdx(project)

Auto-discovery via scan_all also works — any directory containing a go.mod is detected and parsed automatically.