cmd/govulncheck: fail in GOPATH mode
cmd/govulncheck: fail in GOPATH mode

govulncheck requires module information to find vulnerabilities.
But in GOPATH mode, there is no module information.
Instead of silently succeeding in that case, govulncheck fails with an error.

Also, fix an off-by-one bug that could result in a panic if only the top
function in a call stack is in a top package.

Fixes golang/go#51591

Cherry-picked: https://go-review.googlesource.com/c/exp/+/394774

Change-Id: I9923c1f03aa0a101de86fe03daaeeefc1d1f5bdf
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/395241
Trust: Julie Qiu <8d32267b6b4884cf35adeaccde2b6857ae11aace@golang.org>
Run-TryBot: Julie Qiu <8d32267b6b4884cf35adeaccde2b6857ae11aace@golang.org>
Reviewed-by: Jonathan Amsterdam <e3d3698b2ccd5955e4adf250d0785062d0f9018b@google.com>
TryBot-Result: Gopher Robot <66cb808b70d30c07676d5e946fee83fd561249e5@golang.org>

golang/vuln,golang/vuln