go/scanner: reject BOMs that are not at the beginning

For compliance with gc. See also issue 5265.
Not Go1.1 critical, but harmless.

R=r
CC=golang-dev
https://codereview.appspot.com/8736043