Update to Go 1.17

Go 1.17 now lazy-loads dependencies when `go.mod` is version `go17`. This does not work for us for new projects started with `hugo mod init`.

Before this commit, starting a project with Go 1.17 with `hugo mod init` and then start adding dependencies with transitive dependenies to `config.toml` would treat the transitive dependencies as new, and you would potentially get a too recent version of those.

Note that this does not effect existing projects, where all dependencies are already recorded in `go.mod`.

Fixes #8930

modules/collect.go

@@ -252,15 +252,22 @@ func (c *collector) add(owner *moduleAdapter, moduleImport Import, disabled bool
 	}
 
 	if moduleDir == "" {
+		var versionQuery string
 		mod = c.gomods.GetByPath(modulePath)
 		if mod != nil {
 			moduleDir = mod.Dir
+			versionQuery = mod.Version
 		}
 
 		if moduleDir == "" {
 			if c.GoModulesFilename != "" && isProbablyModule(modulePath) {
 				// Try to "go get" it and reload the module configuration.
-				if err := c.Get(modulePath); err != nil {
+				if versionQuery == "" {
+					// See https://golang.org/ref/mod#version-queries
+					// This will select the latest release-version (not beta etc.).
+					versionQuery = "upgrade"
+				}
+				if err := c.Get(fmt.Sprintf("%s@%s", modulePath, versionQuery)); err != nil {
 					return nil, err
 				}
 				if err := c.loadModules(); err != nil {