cmd/go: add go.sum entries to go mod download -json output

Clients of 'go mod download', particularly proxies, may need
the hashes of the content they downloaded, for checking against
go.sum entries or recording elsewhere.

Change-Id: Ic36c882cefc540678e1bc5a3dae1e865d181aa69
Reviewed-on: https://go-review.googlesource.com/129802


Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Andrew Bonventre <andybons@golang.org>