modfetch: prevent duplicate hashes in go.sum

To write go.sum, each module and then each hash is looped through.
The hashes are kept in a slice and there is no check to ensure
that hashes were not added or already exist in the file. This
uniques the hashes of each module before writting to prevent
duplicates.

Fixes: #28456

src/cmd/go/internal/modfetch/fetch.go

@@ -26,6 +26,7 @@ import (
 	"cmd/go/internal/lockedfile"
 	"cmd/go/internal/par"
 	"cmd/go/internal/robustio"
+	"cmd/go/internal/str"
 	"cmd/go/internal/trace"
 
 	"golang.org/x/mod/module"
@@ -832,6 +833,7 @@ Outer:
 		for _, m := range mods {
 			list := goSum.m[m]
 			sort.Strings(list)
+			str.Uniq(&list)
 			for _, h := range list {
 				st := goSum.status[modSum{m, h}]
 				if (!st.dirty || (st.used && keep[m])) && !sumInWorkspaceModulesLocked(m) {