Go/Bazel: use gazelle go_deps instead of a vendor directory

MODULE.bazel

@@ -141,6 +141,10 @@ use_repo(
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.22.2")
 
+go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
+go_deps.from_file(go_mod = "//go/extractor:go.mod")
+use_repo(go_deps, "org_golang_x_mod", "org_golang_x_tools")
+
 lfs_files = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_files")
 
 lfs_files(

go/extractor/BUILD.bazel

@@ -21,8 +21,8 @@ go_library(
         "//go/extractor/toolchain",
         "//go/extractor/trap",
         "//go/extractor/util",
-        "//go/extractor/vendor/golang.org/x/mod/modfile",
-        "//go/extractor/vendor/golang.org/x/tools/go/packages",
+        "@org_golang_x_mod//modfile:go_default_library",
+        "@org_golang_x_tools//go/packages:go_default_library",
     ],
 )
 

go/extractor/go.mod

@@ -2,7 +2,11 @@ module github.com/github/codeql-go/extractor
 
 go 1.22.0
 
+// when updating this, run
+//    bazel run @rules_go//go -- mod tidy
+// when adding or removing dependencies, run
+//    bazel mod tidy
 require (
-	golang.org/x/mod v0.15.0
+	golang.org/x/mod v0.16.0
 	golang.org/x/tools v0.18.0
 )

go/extractor/go.sum

@@ -1,5 +1,5 @@
-golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
+golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=