Add option for synchronizing dependencies with k6

[pablochacin]

When developing an extension, it is convenient to keep dependencies shared with k6 synchronized at the same version to prevent conflicts.

In the context of the xk6-disruptor extension, @roobre developed a handy tool for checking the differences between the dependencies of an extension and k6

The tool looks for overlapping dependencies with k6 which do not match the version used in the extension. Those dependencies are logged to stderr, and go get commands are generated to stdout to download the version k6 core is using.

An example of running in the main branch of xk6-disruptor (at the time of writing this issue)

go run hack/depsync/depsync.go 
2023/09/14 16:17:56 detected k6 core version v0.46.0

2023/09/14 16:17:56 Mismatched versions for github.com/spf13/afero:
Ours: v1.2.2
Core: v1.1.2
go get github.com/spf13/afero@v1.1.2
2023/09/14 16:17:56 Mismatched versions for google.golang.org/grpc:
Ours: v1.57.0-dev
Core: v1.56.1
go get google.golang.org/grpc@v1.56.1
2023/09/14 16:17:56 Mismatched versions for golang.org/x/sys:
Ours: v0.11.0
Core: v0.9.0
go get golang.org/x/sys@v0.9.0
2023/09/14 16:17:56 Mismatched versions for github.com/spf13/cobra:
Ours: v1.5.0
Core: v1.4.0
go get github.com/spf13/cobra@v1.4.0

This functionality could be added to xk6 as a help for developers, either as a subcommand or as an option that automatically updates the version before building the binary.

[codebien]

I've found depsync useful. I would suggest having it as a different installable tool rather than having it as a sub-command of xk6.

go install go.k6.io/xk6/cmd/depsync@latest

In this way, it can have an independent lifecycle. @roobre feel free to open a PR and assign the k6-core as the reviewer.

[codebien]

It sounds like we can close this issue, as it is now a dedicated tool https://github.com/grafana/go-depsync.