Go dependencies and broken port

Hello!

I am in charge of maintaining the ports of security/crowdsec and
security/crowdsec-firewall-bouncer, which are currently broken since a
couple of weeks for not providing all Go  dependencies before build time.
I work for the upstream company but had little previous freebsd experience,
hence the bug on my first port submission.

Now, for the short term, I have submitted a fix that builds from a git tag
with all vendored dependencies, and added the patch to
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260264

I understand the previous maintainer (to whom the bug is assigned) has
little time right now to review and commit again,  so if somebody could
have a look it would be greatly appreciated.

In the long term, I'd like to avoid vendoring everything, which is not
recommended by core Go devs anymore.
The version of the port I inherited made use of go:modules from Mk/Uses/
go.mk, but our software has since grown some plugins as sub-projects with
their own dependencies. It was a lot simpler to just call our own Makefile,
as I did in
https://github.com/crowdsecurity/packaging-freebsd/blob/master/security/crowdsec/Makefile

My approach should then be to port the technique from go.mk to our Makefile
(and run "go mod download", "go mod vendor".. by hand).

A bit tricky (it would create one set of .zip and .mod for each plugin) but
it should be doable. What do you think? Is there a simpler way?

Thanks,
Marco