core: prevent release failure

With go1.16 there is a difference between `go mod tidy` and `go mod
download`.
The `go.sum` is not altered in the same way by both commands.
`go mod tidy` must be always called after the `go mod download`.

golang/go#43994

.github/workflows/main.yml

@@ -47,10 +47,10 @@ jobs:
 
       - name: Check and get dependencies
         run: |
+          go mod download
           go mod tidy
           git diff --exit-code go.mod
           git diff --exit-code go.sum
-          go mod download
 
       - name: Documentation validation
         run: make validate-doc