cmd/check: Use go to find imported packages

[radeksimko]

While I appreciate the aim of keeping the implementation simple, I'm afraid we may miss some important implementation details of go list when we launch this tool into the wild.

e.g. testdata directories are generally not meant to be imported (and so we shouldn't parse them when scanning for all eligible *.go files to find imports in), packages may be imported under different names, which go-refs doesn't handle etc. Who knows what other weird edge cases we may bump into...

I'm aware that calling out to go via shell comes at the cost of increased complexity, but I think the cost is ok, if we get better accuracy?

Just food for thought 🥘 💭