Add new spec for go package URLs

PURL-TYPES.rst

@@ -301,6 +301,10 @@ golang
 ------
 ``golang`` for Go packages:
 
+This type was created before Go 1.11 and it is not best suited for
+identifying Go modules. For this purpose, there is an additional `go`
+type for identifying Go artifacts.
+
 - There is no default package repository: this is implied in the namespace
   using the ``go get`` command conventions.
 - The ``namespace`` and `name` must be lowercased.
@@ -313,6 +317,27 @@ golang
       pkg:golang/google.golang.org/genproto#googleapis/api/annotations
       pkg:golang/github.com/gorilla/context@234fd47e07d1004f0aed9c#api
 
+go
+------
+``go`` for Go modules:
+
+- The ``namespace`` is empty.
+- The ``name`` is the unmodified full case-sensitive [Go module path](https://go.dev/ref/mod#module-path).
+  For artifacts in the Go standard library or the Go command, the ``name`` is `stdlib`.
+- The ``subpath`` is the unmodified Go package path within a module.
+- The ``version`` may be a valid [Go version](https://go.dev/doc/toolchain#version) for `stdlib`,
+  [Go module version](https://go.dev/doc/modules/version-numbers), [`(devel)`](https://go.dev/ref/mod#go-version-m),
+  or omitted when empty.
+- The ``qualifiers`` are URL encoded key-value pairs as defined by
+  Go's [`debug.BuildSetting`](https://pkg.go.dev/runtime/debug#BuildSetting).
+  This list can be extended in the future.
+- Examples::
+
+      pkg:go/google.golang.org%2Fgenproto#googleapis/api/annotations
+      pkg:go/github.com%2Fjmorion%[email protected]#api
+      pkg:go/golang.org%2Fx%2Fvuln?vcs=git&vcs.modified=true#cmd/govulncheck
+      pkg:go/golang.org%2Fx%[email protected]?goos=linux#cmd/govulncheck
+
 hackage
 -------
 ``hackage`` for Haskell packages: