cmd/go: 'go list -m' should be deterministic

[hyangah]

Unlike the package-based query (go list)
that would behave like go get underneath (#28014, #27643),
go list -m operates only with the modules already in the cache.
That makes the result stateful, often confusing.

For example,

# the module is not in our module cache yet.
$ go list -u --versions -m example.com/module
go list -m example.com/module: module "example.com/module" is not a known dependency

# package-level query.
$ go list example.com/module
go: finding example.com/module v1.0.0
go: downloading example.com/module v1.0.0
example.com/module

# now, let's run the same query.
$ go list -u --versions -m example.com/module
example.com/module v1.0.0

[bcmills]

I think the underlying use-case is mostly addressed by the fix for #24250: every set of flags that works outside a module should also work inside a module, and go list -m -versions should pretty clearly work everywhere.

That said, go list -m is already deterministic: unless you provide a specific version (or the -versions flag) it restricts its answer to the modules active in the build list, and that set of modules is a deterministic function of the go.mod file.