fix: filter toolchain entries in GoModulesProvider (#387)

## Summary
- `isGoToolchainEntry()` now filters both `go@*` and `toolchain@*`
entries from Go SBOMs, aligning with the JS client's
`isSpecialGoModule()` behavior
- Added unit test verifying both entry types are filtered while normal
modules pass through

Closes [TC-3919](https://redhat.atlassian.net/browse/TC-3919)

## Test plan
- [x] Unit test `test_isGoToolchainEntry_filters_go_and_toolchain`
passes
- [ ] `mvn verify` passes
- [ ] Integration tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -394,10 +394,10 @@ private static List<String> collectAllDirectDependencies(List<String> targetLine
         .collect(Collectors.toList());
   }
 
-  private static boolean isGoToolchainEntry(String dependency) {
-    // Filter out Go toolchain entries like "go@1.18", "go@1.19", etc.
-    // These are not actual dependencies but the Go toolchain itself
-    return dependency.startsWith("go@");
+  static boolean isGoToolchainEntry(String dependency) {
+    // Filter out Go toolchain entries like "go@1.18" and "toolchain@go1.21.0".
+    // These are not actual dependencies but the Go toolchain itself.
+    return dependency.startsWith("go@") || dependency.startsWith("toolchain@");
   }
 
   private String buildGoModulesDependencies(Path manifestPath) {

src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java

@@ -198,6 +198,19 @@ void Test_Golang_MvS_Logic_Disabled() throws IOException {
             == 1);
   }
 
+  @Test
+  void test_isGoToolchainEntry_filters_go_and_toolchain() {
+    // go@* entries should be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("go@1.18")).isTrue();
+    assertThat(GoModulesProvider.isGoToolchainEntry("go@1.21.0")).isTrue();
+    // toolchain@* entries should be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.21.0")).isTrue();
+    assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.22.2")).isTrue();
+    // normal module entries should NOT be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("github.com/spf13/cobra@v0.0.5")).isFalse();
+    assertThat(GoModulesProvider.isGoToolchainEntry("golang.org/x/tools@v0.1.0")).isFalse();
+  }
+
   private String dropIgnoredKeepFormat(String s) {
     return s.replaceAll("goarch=\\w+&goos=\\w+&", "")
         .replaceAll("\"timestamp\" : \"[a-zA-Z0-9\\-\\:]+\",\n    ", "");