Implement Download Protocol's @latest Endpoint

[marwan-at-work]

The Download Protocol mentions this endpoint GET baseURL/module/@t/yyyymmddhhmmss to retrieve a non-tagged package's latest RevInfo (more here https://research.swtch.com/vgo-module)

From vgo's source code, this seem to have changed to GET baseURL/module/@latest https://github.com/golang/vgo/blob/master/vendor/cmd/go/internal/modfetch/proxy.go#L107

Athens needs to add this URL and get the latest RevInfo for a package from the ultimate source of truth (github, gitlab etc) -- This is because asking for the "latest" is always asking for the package's latest commit, regardless of what we have cached.

This is how I think of implementing it:

1. Naively split the module paths by /, and validate the first el is github.com
2. Ask the GitHub API what the default branch is through /repos/:owner/:repo
3. Ask the Github API what the latest commit it /repos/:owner/:repo/commits/:default_branch

Appreciate any feedback :)

[michalpristas]

can we respond with 404 and let vgo handle these? we won't cache them anyway as they are not nicely versioned packages and latest does not support reproducible builds in any way

[marwan-at-work]

@michalpristas As of today, Vgo will fail if we return 404. From a slack conversations, we have two options:

1. Have vgo ignore the GOPROXY for non-tagged modules.

Benefit: Makes Athens only work with tagged modules which makes it cleaner, easier to reason about, and encourages the community to tag their stuff.

Drawback: vgo will need to be updated for this option to work, and significantly change the Download Protocol from its original proposal.

2. If vgo requires the proxies to be non-tag aware, then we can't return 404 and would have to fully implement @latest and all the other endpoints must work with timestamps/shas.

[arschles]

Ref golang/go#26334