go.mod: add test that replace directives aren't added in oss

Prevent future problems like we earlier with go.mod replace directives
(e.g. removing our certstore replace in 6d6cf88d82 or wireguard-go
in ea5ee6f87c, both of which were reactions to problems caused by
go.mod replace in non-root modules, often because people are using tsnet
as a library from another module)

Updates #cleanup

Change-Id: I766715cfa7ce7021460ba4933bd2fa977c3081d2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

gomod_test.go

@@ -0,0 +1,25 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tailscaleroot
+
+import (
+	"os"
+	"testing"
+
+	"golang.org/x/mod/modfile"
+)
+
+func TestGoMod(t *testing.T) {
+	goMod, err := os.ReadFile("go.mod")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f, err := modfile.Parse("go.mod", goMod, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(f.Replace) > 0 {
+		t.Errorf("go.mod has %d replace directives; expect zero in this repo", len(f.Replace))
+	}
+}