[release-branch.go1.10-security] cmd/go/internal/get: use a strings.Replacer in expand

This should be a no-op, but produces deterministic (and more correct)
behavior if we have accidentally failed to sanitize one of the inputs.

Change-Id: I1271d0ffd01a691ec8c84906c4e02d9e2be19c72
Reviewed-on: https://team-review.git.corp.google.com/c/372707


Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>