Reject the -toolexec flag

[imjasonh]

This came up in the discussion of #684 -- the -toolexec flag makes go build execute another command, and generally represents pretty non-standard, advanced usage. A bad build config could set -toolexec not-go and get not-go to be executed by go instead of the regular Go toolchain.

ko aims to make normal usage easy and secure, even if it rejects advanced use cases (e.g., CGO_ENABLED), so we'll just reject -trimpath if it's requested.

[codecov-commenter]

Codecov Report

Merging #752 (c787cb9) into main (9139f45) will decrease coverage by 0.07%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main     #752      +/-   ##
==========================================
- Coverage   51.19%   51.11%   -0.08%     
==========================================
  Files          44       44              
  Lines        3313     3318       +5     
==========================================
  Hits         1696     1696              
- Misses       1404     1408       +4     
- Partials      213      214       +1     

Impacted Files	Coverage Δ
pkg/build/gobuild.go	59.72% <0.00%> (-0.39%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9139f45...c787cb9. Read the comment docs.