cmd/go/internal/modload: fix aliasing bug in (*mvsReqs).Required with -mod=vendor

(*mvsReqs).Required assumes that it is safe to mutate the slice
returned by (*mvsReqs).required. In most cases, that was true, but in
the case of -mod=vendor it resulted in unsynchronized (and
potentially interfering) writes to the global vendorList.

Fixes #30550

Change-Id: I99bcc2037e0182418b7dfda1002f8b540dbf3a1d
Reviewed-on: https://go-review.googlesource.com/c/go/+/170598
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

src/cmd/go/internal/modload/load.go

@@ -976,27 +976,27 @@ func readVendorList() {
 }
 
 func (r *mvsReqs) modFileToList(f *modfile.File) []module.Version {
-	var list []module.Version
+	list := make([]module.Version, 0, len(f.Require))
 	for _, r := range f.Require {
 		list = append(list, r.Mod)
 	}
 	return list
 }
 
+// required returns a unique copy of the requirements of mod.
 func (r *mvsReqs) required(mod module.Version) ([]module.Version, error) {
 	if mod == Target {
 		if modFile != nil && modFile.Go != nil {
 			r.versions.LoadOrStore(mod, modFile.Go.Version)
 		}
-		var list []module.Version
-		return append(list, r.buildList[1:]...), nil
+		return append([]module.Version(nil), r.buildList[1:]...), nil
 	}
 
 	if cfg.BuildMod == "vendor" {
 		// For every module other than the target,
 		// return the full list of modules from modules.txt.
 		readVendorList()
-		return vendorList, nil
+		return append([]module.Version(nil), vendorList...), nil
 	}
 
 	if targetInGorootSrc {