[pkg-go] Go security support in buster

[Shengjing Zhu]

> there were earlier discussions about this before (2015 or so),

So for the first question,
- detects which packages need a rebuild if a given Go package has been
  fixed.

dh-golang now generate Built-Using info for both direct and indirect
build-depends. So any tool deal with Built-Using info can do this.
IIRC, when last time such issue raised, dh-golang can only generate
Built-Using info for direct dependencies. But it's been fixed(probably
in 2016).

-- 
Best regards,
Shengjing Zhu