cmd/go: go list should not add a dependency to go.mod

[hyangah]

This is probably a duplicate of #27643. The thread got too long and I want to bring the attention to the go list command by filling this as a separate issue.

I was in a branch with a v2 module and this doesn't have a dependency on v0 or v1.

$ go list github.com/hyangah/foo/v2
github.com/hyangah/foo/v2 
$ cat go.mod
module github.com/hyangah/foo/v2

I queried the package in v1 by accident and found the go.mod was updated.

$ go list github.com/hyangah/foo
github.com/hyangah/foo
$ cat go.mod
module github.com/hyangah/foo/v2

require github.com/hyangah/foo v1.0.1 // indirect

[bcmills]

This is probably a duplicate of #27643.

Yep, same general idea.

In the long term, I expect that most folks will want to have go mod tidy (or some wrapper around it) as a commit hook (see #27005).

[bcmills]

This is probably a duplicate of #27643.

Actually, I think it's closer to #28692. (#27643 is about go get, which is a command that explicitly pulls in depedencies.)