Standard stdlib package list is way too broad, need to exclude (at least) go/ (and some of runtime/ too) (eg go/version and runtime/metrics)

[ldemailly]

Currently it generates way too many false positives for packages that are not conflicting with stdlib as despite not being internal they... are internal to the go command line or runtime metrics

Originally posted by @ldemailly in #1593 (comment)

[ldemailly]

runtime/pprof is fine to complain about for instance, so it's less clear... but in general going from a list of 10 before to 171 now seems bound to create havoc

[bconway]

Strong agree. I would argue that no one thinks of the Go standard library when encountering packages user or token.

[ldemailly]

got a workaround in #1602 (comment) but it's not quite working yet (or I'm holding it wrong which is very much possible but my PR for config update breaks)

[ldemailly]

fixed thanks to ludovic fortio/workflows@6ebef17