Vet our use of go list

We should be cautious with using `go list -compiled -json=CompiledGoFiles`, which we're using to gather a list of sources to scan - I'm not sure how public that is (or not). It might be the case that there's a better way to access this (rather than executing an external process), too.

It might be that there isn't, and that this command line interface is supposed to be stable. I simply don't know.