Add go-build method

[wagoodman]

This adds a new go-build install method, which acts similar to go install, however, without the inherent limitations (such as not permitting replace directives). This new method will fetch the source from either the upstream github repo (via shallow clone) or from the go proxy directly (controllable via the source configuration) and perform a go build. Like with the go-install installation method, this responds to local modules (skips fetching source) when there is a local path given (such as . or ./cmd/tool).

This additionally fixes a logging issue introduced with #228 (the wrong logger was plumbed through context).

[kzantow]

Should this just be a fallback to go-install? I did that in this branch fixing a few things for other platforms. The larger problem is that some platforms have prebuilt assets and others don't so a single binny.yaml often doesn't work across platforms without everything being go-install or, go-build now.

[wagoodman]

Adding a go-build method doesn't really have anything to do with prebuilt assets (from the github-release install method, right?).

I didn't know about the other branch in question! I think it solves the problem nicely, however, there are two problems:

• if the user is explicitly saying to use go-install and we don't actually use go install then that could be surprising (go install is reproducible where as builds are not necessary so)
• the branch uses the module as the repo to git clone, but this will not always work. This approach allows the user to say "always get the source from the go proxy instead of the repo" as well.

[kzantow]

Adding a go-build method doesn't really have anything to do with prebuilt assets (from the github-release install method, right?).

Right, just pointing out the larger problem of needing fallbacks. go-install vs go-build isn't really as much a needed fallback, but the scenario is we have a go-install configured and the project gets updated with a replace directive and it breaks and now we have to reconfigure everything to be go-build for that specific tool. Then later the replace directive gets removed again, we would want to go back to go-install. I'm not opposed to adding this, but I'm just pointing out that it is solving a problem that will be transient across particular tool releases.

[kzantow]

It seems like we have this code somewhere else, maybe multiple other places (in syft, for example, go get go licenses)... it would be great not to duplicate it