Make goenv parsing robust across go versions and OSes

[liggitt]

Fixes #449

[quasilyte]

Thank you for the investigation and this fix!

[liggitt]

the lint check failed because it thinks this can inject args into the process invocation:

Error: internal/goenv/goenv.go:10:14: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec)
	out, err := exec.Command("go", append([]string{"env"}, varNames...)...).CombinedOutput()

we could hard-code the envs we look up instead of passing them in, but that would make unit testing harder

[liggitt]

opened follow-up in #456 to see if that makes the linter happier