The go sum db is a hosted service that appears to be generating a new
inclusion proof each time this build is run (rather than using the one
from the previous run). Since this ends up the module directory + thus
hash, it's breaking deterministic builds.
Co-authored-by: Roman Volosatovs <rvolosatovs@riseup.net>