The list of dependencies for a repo right now is equal to the list of deps
mentioned in the require directive in the repo's go.mod file.
This means that we loose all transitive deps mentioned in the replace
directive in go.mod files.
So instead use all deps mentioned in the replace directive, and prune
any extra dependencies.
Also add a test for this in verify-publishing-bot.py
