cmd/go: save zip sums for downloaded modules in 'go mod download' in a workspace
Within a single module we expect all needed checksums to have already
been recorded by a previous call to 'go get' or 'go mod tidy' in that
module. However, when we combine multiple modules in a workspace, they
may upgrade each other's dependencies, so a given module might be
upgraded above the highest version recorded in the individual go.sum
files for the workspace modules.
Since the checksums might not be present in individual go.sum files,
record them in go.work.sum.