Placing a "plugin" file in the `dists/<repo>` folder will trigger a
-buildmode=plugin build using CGO.

The build process:

  * Sets a custom GOPATH
  * Clones the repo we want to build inside it
  * Does a go mod init and requires the repository we want to build directly (ignoring submodules) by doing a "rev-parse HEAD" on what we cloned
  * Then go-builds the package "go build [...] -mod=mod my.package/abc.

I'm not sure why -mod=mod is updated, but this automatically updates the
go.mod when working with submodules (sub-packages) that are tagged separately,
to the point that it uses wrong releases (not the checked out one).

This has not been noticed in 4 years because we usually build the last tagged
version of things. It you attempt to build a submodule with their own tag
while using a tag that is not the latest it will start misbehaving.

This attempts to require exactly what we are trying to build in the go.mod file.