feat: Saving the nogo fixes

[peng3141]

What type of PR is this?

Feature

What does this PR do? Why is it needed?

nogo analyzers may produce fixes as analysis.Diagnostic. This PR allows rules_go to save the fixes as patches, one per target. The patch and the command to apply the patch is printed out to the terminal for users to manually apply. The patch is also available in the "nogo_fix" output group. This allows people to get patches for all targets without failing the build by passing --norun_validations --output_groups nogo_fix.

Example output:

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging

nogo: errors found by nogo during build-time code analysis:
src/example.com/send_request.go:133:4: Add and Done should not both exist inside the same goroutine block (example_nogo_analyzer)

-------------------Suggested Fix-------------------
--- src/example.com/send_request.go
+++ src/example.com/send_request.go
@@ -123,6 +123,7 @@
 
 	for !isComplete {
 		<-ticker.C
+		concurrentJobs.Add(1)
 		go func() {
 			text, hasMore := <-line
 			if !hasMore {
@@ -130,7 +131,6 @@
 				return
 			}
 
-			concurrentJobs.Add(1)
 			defer concurrentJobs.Done()
 
 			atomic.AddInt32(&totalSend, 1)

-----------------------------------------------------

To apply the suggested fix, run the following command:
$ patch -p1 < bazel-out/k8-fastbuild/bin/src/example.com/send_request.nogo.patch

Target //src/example.com:send_request failed to build
Use --verbose_failures to see the command lines of failed build steps.

Other notes for review
An analyzer may suggest multiple alternative fixes to one issue. Only the first one is selected by default, unless it conflicts with other fixes, in which case it moves on to try the next alternative. If all alternatives are tried but still have conflicts, they will be skipped. In such case, the user will have to apply the patch first, and run nogo again to get the fix to the issue.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[peng3141]

thanks for the comments, i am in the process of addressing them.

[peng3141]

this shows the log of the latest version:
https://gist.github.com/peng3141/bdaefac333434cf2ecbef4edfd8d0200

[peng3141]

@fmeum @linzhp the PR is ready for review. Could you take a look? thanks!

could you focus on the high-level design, once it is agreed upon, we can have one pass to address the readability nits.

[linzhp]

Only half way through, posting some comments so far. I will continue later this week

[peng3141]

half way, will handle the rest tmr.

[peng3141]

landing is blocked by the central CI infra issue: bazelbuild/continuous-integration#2153.