fix(gomod): prefer version specified by toolchain directive when present

[G-Rath]

Unlike with go, the toolchain directive holds the name of an actual toolchain which is prefixed with go and can have a suffix - when comparing, these should be ignored:

Toolchains are compared by comparing the version V embedded in the name (dropping the initial go and discarding off any suffix beginning with -)

However, I'm not sure if that's an extractor-level concern - if it's not, then I think we'll need to include a custom version comparator for semantic to handle that, and ensure comparators elsewhere like osv.dev account for this.

Resolves google/osv-scanner#1606

[another-rex]

I think practically we have made it an extractor level concern (not sure whether that's a good thing or not). Right now we are really only using the go version to determine the standard library version, and that's also what this toolchain directive will be for as well, so let's make it trim the go prefix.

Pull Request Overview

This PR updates the Go module extractor to prioritize the version specified by the toolchain directive, ensuring that any suffix after a '-' is discarded before comparison. Key changes include:

• Adding logic in gomod.go to extract and use the toolchain version when present.
• Adding test cases in gomod_test.go to validate correct extraction from toolchain declarations, including cases with suffixes.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
extractor/filesystem/language/golang/gomod/gomod.go	Introduces support for using the toolchain version by trimming the “go” prefix and any suffix.
extractor/filesystem/language/golang/gomod/gomod_test.go	Adds tests to ensure proper behavior when the toolchain directive is present with or without a suffix.