Need CI test that repo is not dirty after build+test

[danderson]

While trying to build reproducibly:

$ ./build_dist.sh -mod=readonly tailscale.com/cmd/tailscaled
go: updates to go.sum needed, disabled by -mod=readonly
$ ./build_dist.sh tailscale.com/cmd/tailscaled
$ git diff
+github.com/tailscale/wireguard-go v0.0.0-20201228234719-da0d2727455d h1:ha3qx0YBsEYM1VpLoAxVyLsz74H2a/Kv/id+2Bo/WLU=
+github.com/tailscale/wireguard-go v0.0.0-20201228234719-da0d2727455d/go.mod h1:FEGDKc5yHNWtTS5ugWnHMNF0d9LlaHv/zQwOrVogo2U=

Last commit was @josharian updating go.mod to a new wireguard-go version. I'm guessing he didn't do a build, and so go.sum wasn't updated. This leads to reproducibility sadness, because the git repo becomes dirty and so we embed a -dirty version even though we started out with a clean build (not to mention in the absence of the go.sum entry, there's a TOFU issue with the wireguard-go commit).

Maybe we should add a CI check that the git repo isn't dirty after the CI's done build+test?

Part of #779

[danderson]

Fixed tailscale/tailscale by hand for now, by committing the changed go.sum. Leaving open to work out how to avoid this regression in future.

[josharian]

Ugh. I only committed the changed go.mod because the corp push build script updated it, and I got tired of fighting the build script. Maybe that build script should update go.sum at the same time? Or have an option to not modify go.mod.