More accurate matching

[JohnAnthony]

So, a little bit of thought about how to make this tool more useful.

1. Under-matching: Banish currently just matches against the go.mod file, which means that, for example, a search for /foo/bar/baz will fail to notice the dependency if the go.mod file contains require /foo/bar. I think this will have to be some kind of trie matching by breaking the URI into components.
2. Over-matching: If we fix the under-matching, we'll have a lot of matches on large imports - especially for monorepos - even if the actual Go imports never use the path we're matching against. The only solution for this, I think, is to search all the .go files in the repo and actually find out if the path is imported.
3. Output: If we do point 1 and 2, we will have information about the files that contain relevant imports. We can list them right down to the line number.

[JohnAnthony]

Thought of a better way of wording this: we can take a package path rather than a module path. We would still match against the package's parent module in go.mod to determine the version, but would search through go files to see if the package path is actually used.

We'd replace the -modules flag with -packages.