Feature request: Use go workspaces to remove http module from dependents

[Proximyst]

CVE-2022-31022 is currently an advisory on the Bleve package due to the http package -- this is entirely understandable and correct. However, due to the http package's presence in the root module, any app that depends on bleve will also get this advisory by security scanning tools (e.g. AWS Inspector).

One example is in Grafana: docker scout cves grafana/grafana:latest:

$ docker scout cves grafana/grafana:latest
...
## Packages and Vulnerabilities
   0C     0H     1M     0L  github.com/blevesearch/bleve/v2 2.4.3
pkg:golang/github.com/blevesearch/bleve@2.4.3#v2

    ✗ MEDIUM CVE-2022-31022
      https://scout.docker.com/v/CVE-2022-31022
      Affected range : >=0
      Fixed version  : not fixed

To solve this, I'd like to request the bleve repository to use Go workspaces. This would let us depend on all of Bleve except for its example code, and solve the CVE we have reported on our software.

[rgoltz]

@CascadingRadium - You closed this issue as "completed" - Does bleve repository now using Go workspaces that enable us to fine-grained control this modules? (to disable this http package via config).

[CascadingRadium]

@rgoltz @Proximyst the bleve/http package has now been removed/relocated to another repository; See: #2156