Move submodule update command to `rivershared` + check for go/toolchain + workspace

[brandur]

This one's a bit of a grab bucket, but do a few refactors and additions:

• Bring the project over to use a Go workspace, thereby letting us run tests and programs across module directories and cut out our replace statements in go.mod all over the place.

• Move the River version update program for go.mod files over to rivershared so that it can be used by other River projects. It's modified so that instead of hardcoding a submodule list, it can now read them straight out of the project's workspace in go.work.

• Add a new program that's similar to this one whose job it is to check that the go/toolchain directives across all go.mods in the workspace match, which will help prevent accidental regressions of

  522. It can also be used locally to update go/toolchain

  directives to new values in case we want to do that in the future.

• Do a lot of repaving in Makefile so that we can use list of submodules from the workspace to run a series of commands instead of needing to maintain independent lists for each target, a practice that was often unreliable.

[brandur]

@bgentry Just to summarize a bit, this one brings in:

• Workspace.
• Modified the go.mod version update script so it goes to rivershared and can be used by other River projects (so we don't have the code duplicated in every repo).
• Added new script that verifies all versions are in sync. See new submodule_check CI job.

[brandur]

Thanks!

As discussed, let's give this a shot in the main project for a while, and revert in case it doesn't work out for some reason.