This introduces a depth-first traversal of the import graph; gps can't
help, because we're exploring a GOPATH workspace, which gps explicitly
does not do.
init now creates a provisional lock file from the version information it
inferred while scanning the workspace. The provisional lock is used to
bootstrap a solve run that will:
* Retain the versions given in the provisional lock
* Pick versions for any direct deps that were in the import graph, but
not found in the workspace
* Pull in and pick versions for any needed transitive deps according to
the rules in dep's analyzer (currently very dumb)
This logic relies on another new stub function to handle the huge
variety of failures that solving can have; that's going to be a
significant and ongoing area of work.
We're still not writing out the vendor directory just yet, though that
should be just one more gps function call.
init now scans the code tree of the project it is init-ing and attempts
to make a sane determination about what constraint it should apply for
each non-stdlib project root it encounters.
This adds another handwavy stub method - this one for figuring out what
version of code is currently on disk - but it illustrates intent, and we
can fix that later.