.golangci.yaml: warn if go.mod/go.sum is dirty

Settin modules-download-mode: readonly causes the linter to complain,
rather than silently letting the tooling fix things up behind the
scenes. This is a good belt and suspenders check to ensure whats in the
commit is what is built at that commit.