use go.mod, declare a version of the API

[indrora]

pkg.go.dev is pushing for packages to

• Declare dependencies in go.mod
• Tag a v1

[makew0rld]

@kevinburke could this be added? It's important to ensure the library is built the same way every time, and doesn't break when some remote dependency gets upgraded.