GeezerVison

Closes #930. An alternative to #1347: this branch keeps @Montana's commit from #1347 and fixes it on top.

src now warns on stderr when it is older than the version your instance recommends (/.api/src-cli/version, the same lookup src version does):

⚠️  Warning: src-cli 6.4.1 is older than 7.6.0, the version recommended by https://sourcegraph.example.com. To upgrade, see https://github.com/sourcegraph/src-cli#installation. To silence this warning, set SRC_SKIP_VERSION_CHECK=1.

How it works

• The check runs once per process from config.apiClient, so it uses the command's own endpoint and flags, such as -insecure-skip-verify. Commands that never talk to the instance, such as src search -h, do no lookup.
• The recommended version is cached for 24 hours per endpoint, in a file under os.UserCacheDir()/sourcegraph/src-cli/. Failed lookups are cached too.
• The lookup has a 3 second timeout and never fails the command.
• src version always asks the instance, as before. It now warns from that answer and writes it to the cache, so the commands that follow warn about the same version. It still makes one request, and src version -client-only makes none.
• There is no check for dev builds, or when SRC_SKIP_VERSION_CHECK is set.

Fixes on top of #1347

• Panic. feat: warn when src-cli is older than the instance's recommended version #1347 built its client from &api.Flags{}, which internal/api dereferences, so every command in a release build crashed. Dev builds skip the check, which hid it.
• Wrong instance. The check ran before flag.Parse(), so it ignored -endpoint, -config, and -insecure-skip-verify.
• A request on every command. There was no cache, so an instance that does not answer delayed every command by 3 seconds.
• src version and src search version skipped the check. src version now warns from its own lookup, and arguments are no longer scanned for version.
• Version parsing now uses Masterminds/semver instead of a hand-written parser. It is already linked in through sourcegraph/lib; go.mod moves it from indirect to direct.
• Tests now run the real API client against a fake instance. feat: warn when src-cli is older than the instance's recommended version #1347 tested only the helper functions.
• Docs. A CHANGELOG.md entry. The warning itself names SRC_SKIP_VERSION_CHECK and links to the upgrade instructions.

Decisions to review

• The check is a side effect of config.apiClient, the one place where the endpoint and a command's parsed flags meet.
• The warning prints on every command while src is outdated, including in CI and when stderr is not a terminal.
• A prerelease such as 7.4.0-rc.0 is warned when the instance recommends 7.4.0.
• A failed lookup silences the check for 24 hours. That includes a command run against a self-signed instance without -insecure-skip-verify.
• Without a writable cache directory there is no check.

Test plan

go test -race ./cmd/src and ./dev/go-lint.sh ./cmd/src/... pass.

Real instance. Built this branch with BuildTag set to 6.4.1 and to 7.6.0, and ran both against sourcegraph.sourcegraph.com, which recommends 7.6.0:

Local fake instance, only for what the real instance cannot show: request counts, a changing answer, an untrusted certificate, and an instance that hangs. Built as 6.4.1; the fake recommends 6.5.0: