ci/cd: ship tarballs with vendored deps

[mohammed90]

This adds 2 tarballs in the release:

• caddy_{{ .Version }}_buildable-artifact.tar.gz: this contains a main.go, go.mod, and go.sum along with a vendor/ tree containing all the deps, including Caddy's own source tree as a dep. This allows the user to run go build against the exact files used to build our releases.
• caddy_{{ .Version }}_src: this packages Caddy's git tree as-is along with the vendor/ directory of vendored deps.

To test, run:
TAG=master goreleaser release --skip-publish --snapshot --clean

Closes #4573

[francislavoie]

Nice. Those get signed too, right? I think that's all still automated on top of that?

[mholt]

Cool, thank you for doing this!