Simple solution to locking golang package version dependencies