When go autodetects that it is being run as a go mod, and that there is
a vendor directory, it will still try to redownload all sources over the
network, unless you use -mod=vendor to tell it to use that. Additionally,
when using -mod=vendor the compiler will nicely avoid messing with
$GOPATH at all, since it can operate in a completely self-contained
manner.

Take advantage of this, when the detected go version is at least 1.11
(when the -mod flag was introduced).