dependencyverifier: record indirect-only unwanted modules

The nil check inside the referencer loop tested the map that the code
above had just created, so it never ran. An unwanted module whose only
referencers are main modules listing it as an indirect dependency got no
status.unwantedReferences key at all; google/btree, reached through the
go.mod-less peterbourgon/diskv v2, was invisible this way until diskv
v3.0.1 gave it a visible referencer.

Check for the key instead, so the next module in that situation shows up
as an empty entry.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

cmd/dependencyverifier/dependencyverifier.go

@@ -287,8 +287,10 @@ func main() {
 			return ri.version < rj.version
 		})
 		for _, referencer := range unwantedToReferencers[unwanted] {
-			// make sure any reference at all shows up as a non-nil status
-			if config.Status.UnwantedReferences == nil {
+			// make sure any reference at all shows up as a non-nil status,
+			// even when every referencer is a main module that only lists the
+			// unwanted module as an indirect dependency
+			if _, ok := config.Status.UnwantedReferences[unwanted]; !ok {
 				config.Status.UnwantedReferences[unwanted] = []string{}
 			}
 			// record specific names of versioned referents