Force go mod graph even when go list errors out

[prabhu]

go list -deps command could fail in enterprise environments for a few reasons such as:

• Misconfiguration: private dependencies were not configured correctly
• cdxgen invoked with only go.mod files without the full source code
• Build errors

In such cases, we can force an SBOM creation by allowing only the use of go mod graph. The resulting SBOM might have false positives, which could be improved subsequently.