internal/worker: set GOSUMDB=off by default

- Skip checksum server verification when downloading modules.
- This should reduce the number of errors due to checksum server
  verification.
- Downloads should also increase by skipping this phase for every module
  download.

Change-Id: I6b3863c32177cdaab24d2b6de794c9fbaf7aade8
Reviewed-on: https://go-review.googlesource.com/c/pkgsite-metrics/+/696537
Reviewed-by: Markus Kusano <kusano@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Ethan Lee <ethanalee@google.com>

internal/worker/scan.go

diff --git a/internal/worker/scan.go b/internal/worker/scan.go
index 22be99e..babae13 100644
--- a/internal/worker/scan.go
+++ b/internal/worker/scan.go
@@ -324,6 +324,7 @@
 	cmd.Dir = opts.dir
 	cmd.Env = cmd.Environ()
 	cmd.Env = append(cmd.Env, "GOPROXY=https://proxy.golang.org/cached-only")
+	cmd.Env = append(cmd.Env, "GOSUMDB=off")
 	if !opts.insecure {
 		// Use sandbox mod cache.
 		cmd.Env = append(cmd.Env, "GOMODCACHE="+filepath.Join(sandboxRoot, sandboxGoModCache))