cmd/go: fix module get -u to avoid spurious new deps
If we have go get -u x1@v1 x2@v2 and x1 depends on x2,
use v2 as the "upgraded" x2 chosen by -u instead of
letting -u pick something (say, v2.1) and then immediately
overriding it. This avoids chasing down the deps from v2.1
and also avoids them polluting the overall module graph.
This fix also lets us delete some code in the preparation step,
reducing the overall latency of get -u.
Suggested by Bryan Mills in
https://go-review.googlesource.com/c/vgo/+/122396/6#371.
Fixes #26342.
Change-Id: I50fa842304820d3f16f66a8e65dea695e2b0f88b
Reviewed-on: https://go-review.googlesource.com/124856 Reviewed-by: Bryan C. Mills <bcmills@google.com>