Replace go get reflex

[anton-johansson]

We do this in make dev-go:

$ go get github.com/cespare/reflex

This causes the go.mod file to change, which we do not want. See golang/go#27643. Is there an alternative approach to installing a tool without changing the dependency graph?

[anton-johansson]

Same with shurcooL/vfsgen. We use it in the build process to embed static files. It pollutes the go.mod and go.sum too.

[anton-johansson]

See golang/go#32504

I tried the tools.go, but for two out of three tools I use I get the following message:

cmd/kertificate/tools.go:7:2: import "github.com/google/addlicense" is a program, not an importable package

EDIT: Actually, the tools.go solution works if I put it in the root. The compiler therefore won't reach that file, but it's still considered for go.mod. I think this solution is good enough for now. The above issue is marked for milestone 1.14, so maybe we can revisit this later.