fix(go): drop support for old space-separated exhortignore format in indirect deps

The old format (// indirect exhortignore) is no longer supported — only the
semicolon format (// indirect; exhortignore) is accepted. This aligns with the
JS client and avoids issues with go mod tidy mangling comments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -567,7 +567,7 @@ public boolean IgnoredLine(String line) {
       // then this line is to be checked if it's a comment after a package name.
       if (Pattern.matches(".+//\\s*(exhortignore|trustify-da-ignore)", line)
           || Pattern.matches(
-              ".+//\\s*indirect\\s*;?\\s*(//)?\\s*(exhortignore|trustify-da-ignore)", line)) {
+              ".+//\\s*indirect\\s*;\\s*(//)?\\s*(exhortignore|trustify-da-ignore)", line)) {
         String trimmedRow = line.trim();
         // filter out lines where exhortignore or trustify-da-ignore has no meaning
         if (!trimmedRow.startsWith("module ")

src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java

@@ -229,6 +229,32 @@ void Test_Golang_MvS_Enabled_Preserves_All_Transitive_Dependencies() throws IOEx
             + "getFinalPackagesVersionsForModule() is losing transitive dependencies.");
   }
 
+  @Test
+  void test_IgnoredLine_rejects_old_space_separated_indirect_format() {
+    var provider = new GoModulesProvider(Path.of("go.mod"));
+    // Old format (space-separated, no semicolon) should NOT be recognized
+    assertThat(
+            provider.IgnoredLine(
+                "        github.com/foo/bar v1.0.0 // indirect trustify-da-ignore"))
+        .isFalse();
+    assertThat(provider.IgnoredLine("        github.com/foo/bar v1.0.0 // indirect exhortignore"))
+        .isFalse();
+    // New semicolon format should still be recognized
+    assertThat(
+            provider.IgnoredLine(
+                "        github.com/foo/bar v1.0.0 // indirect; trustify-da-ignore"))
+        .isTrue();
+    assertThat(provider.IgnoredLine("        github.com/foo/bar v1.0.0 // indirect; exhortignore"))
+        .isTrue();
+    assertThat(
+            provider.IgnoredLine(
+                "        github.com/foo/bar v1.0.0 // indirect; //trustify-da-ignore"))
+        .isTrue();
+    assertThat(
+            provider.IgnoredLine("        github.com/foo/bar v1.0.0 // indirect; //exhortignore"))
+        .isTrue();
+  }
+
   @Test
   void test_isGoToolchainEntry_filters_go_and_toolchain() {
     // go@* entries should be filtered