x/vgo: create go.modverify by default

[FiloSottile]

The security provided by go.modverify should not be opt-in.

I elaborated on why locking hashes into repositories is so important at https://groups.google.com/d/msg/golang-dev/MNQwgYHMEcY/Jl-piUJ_CgAJ

There is no reason we should encourage not using it, at least not until we have a solid story about alternative verification methods.

[rsc]

As I wrote on #24117:

Not yet. We're fixing one thing at a time. The first thing to fix is management of versions at all. The second thing is verification. There's no need to do both at once. We've gotten by this long with "go get" with no modverify. Let's get versions into go first, and then turn our attention to verifying.

Especially if we do have a solid plan for alternate verification methods, there is no point to littering everyone's repos with go.modverify files that will not be necessary in the long run.