fix(go): handle replace directives in go list -m all parsing

The stream filter in getFinalPackagesVersionsForModule() only accepted
2-part lines from `go list -m all`, silently dropping replace directive
lines (5-part format: name v1 => replacement v2). This caused replaced
modules to be absent from the MVS version map, resulting in incorrect
SBOM versions.

Extract parseModuleVersions() to handle both standard and replace
directive lines, mirroring the JS client fix (PR #505).

Implements TC-4359

Assisted-by: Claude Code

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -347,12 +347,7 @@ private Map<String, List<String>> getFinalPackagesVersionsForModule(
     Operations.runProcessGetOutput(manifestPath.getParent(), goExecutable, "mod", "download");
     String finalVersionsForAllModules =
         Operations.runProcessGetOutput(manifestPath.getParent(), goExecutable, "list", "-m", "all");
-    Map<String, String> finalModulesVersions =
-        Arrays.stream(finalVersionsForAllModules.split(Operations.GENERIC_LINE_SEPARATOR))
-            .filter(string -> string.trim().split(" ").length == 2)
-            .collect(
-                Collectors.toMap(
-                    t -> t.split(" ")[0], t -> t.split(" ")[1], (first, second) -> second));
+    Map<String, String> finalModulesVersions = parseModuleVersions(finalVersionsForAllModules);
     Map<String, List<String>> listWithModifiedVersions = new HashMap<>();
     // Process all entries, including those without versions (like the root module)
     edges.forEach(
@@ -387,6 +382,24 @@ private Map<String, List<String>> getFinalPackagesVersionsForModule(
     return listWithModifiedVersions;
   }
 
+  /**
+   * Parses {@code go list -m all} output into a map of module names to their final resolved
+   * versions. Handles both standard lines ({@code name version}) and replace directive lines
+   * ({@code name v1 => replacement v2}).
+   */
+  static Map<String, String> parseModuleVersions(String goListOutput) {
+    return Arrays.stream(goListOutput.split(Operations.GENERIC_LINE_SEPARATOR))
+        .map(String::trim)
+        .map(line -> line.split(" "))
+        .filter(parts -> parts.length == 2 || (parts.length >= 4 && parts[2].equals("=>")))
+        .collect(
+            Collectors.toMap(
+                parts -> parts[0],
+                parts ->
+                    parts.length >= 4 && parts[2].equals("=>") ? parts[parts.length - 1] : parts[1],
+                (first, second) -> second));
+  }
+
   private List<String> getListOfPackagesWithFinalVersions(
       Map<String, String> finalModulesVersions, List<String> packages) {
     return packages.stream()

src/test/resources/tst_manifests/golang/go_mod_light_no_ignore/expected_sbom_stack_analysis.json

@@ -263,11 +263,11 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
+      "bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.0",
       "group": "gopkg.in",
       "name": "yaml.v3",
-      "version": "v3.0.1",
-      "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1"
+      "version": "v3.0.0",
+      "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.0"
     },
     {
       "type": "library",
@@ -497,7 +497,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
+      "ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.0",
       "dependsOn": [
         "pkg:golang/gopkg.in/check.v1@v0.0.0-20161208181325-20d25e280405"
       ]

src/test/resources/tst_manifests/golang/go_mod_light_no_ignore/go.mod

@@ -6,3 +6,5 @@ require golang.org/x/tools v0.0.0-20210112183307-1e6ecd4bf1b0
 require github.com/spf13/cobra v0.0.5
 
 require gopkg.in/yaml.v3 v3.0.1 // indirect
+
+replace gopkg.in/yaml.v3 v3.0.1 => gopkg.in/yaml.v3 v3.0.0