apiviewgo parses non-SDK modules as needed

[chlowell]

When apiviewgo finds a type alias referencing a non-SDK module, it will parse that module's source from the local mod cache or download it from the Go module proxy, and hoist the definition to the API it's reviewing. Parsing and definition-hoisting logic is unchanged; this PR just adds the ability for apiviewgo to parse code not residing in the SDK repo.

Closes #7866

[RickWinter]

The linked issue talks about an allow list. I don't see that, are we not doing that? How do we prevent exporting types from libraries we don't own?

[chlowell]

I decided against the allow list because I didn't see a benefit worth the friction. The review process from PR to apiview prevents exporting types we don't own; it's clear at each stage where a type comes from. It does rely totally on human judgment though. Do you think we need a hard barrier?

[RickWinter]

I decided against the allow list because I didn't see a benefit worth the friction. The review process from PR to apiview prevents exporting types we don't own; it's clear at each stage where a type comes from. It does rely totally on human judgment though. Do you think we need a hard barrier?

It should be fine to not have it since its clear in the Apiview where the types are coming from.