fix: ignore reference to 'go@version' from newer go mod graph output

[Strum355]

Description

Related issues (if any): #184 (comment)

• fixes: Research alternatives to go mod graph for Go provider #184 (comment)

Checklist

• I have followed this repository's contributing guidelines.
• I will adhere to the project's code of conduct.

Additional information

Anything else?

[ruromero]

I don't know if we should remove it from newer or add it in older. The go standard library is part of the software components so IMO it adds more context to the generated SBOM. Also there might be some CVEs that affect specific go versions:
example: https://www.cve.org/CVERecord?id=CVE-2024-24790 or https://www.cve.org/CVERecord?id=CVE-2025-22866

[ruromero]

As discussed offline. It's better to ignore it completely as the go version should be part of the SBOM that includes the rpm/deb packages etc. Example: pkg:deb/debian/golang-1.22
The reason is that the project doesn't have a direct dependency to a specific golang version (only minimum required go version), the actual version is resolved at build time and depends on the tools available during build. We are generating an SBOM of the project's dependencies, not the build artifact dependencies.