[pkg-go] Go security support in buster

[Florian Weimer]

* Michael Stapelberg:

> I thought haskell was in a similar boat? They have tooling to schedule
> binNMUs for affected packages.

My understanding is that you can't simply schedule binNMUs on the
security archive because the security archive does not have the
sources until the first upload of the package.  (But I'm a bit out of
touch; this may have changed.)