(This is a very quick attempt at "what this will look like")

This repository provides both command-line utilities, and a module for external
consumers.

Currently, both are part of the same module; as a result, dependencies of both
the module *and* the command-line utilities are listed in the repositories go.mod.
This affects consumers of this project, because (due to go module's nature of
dependency (version) resolution), those consumers will inherit all dependencies,
or will be "forced" to use the same version of the CLI dependencies.

This is a very quick attempt at separating the CLI utilities from the "module",
by creating a separate go.mod (and module) for the CLI utilities.

I'm not fond of the name (github.com/containerd/imgcrypt/cmd) for that module
(possibly renaming to github.com/containerd/imgcrypt/cli would be slightly
clearer).

This change _will_ add some additional work when tagging releases; a separate tag
should be created for the cli utilities (tagging as `cmd/vX.Y.Z`), and the
"github.com/containerd/imgcrypt" dependency in the go.mod inside the cmd directory
may need to be updated to reflect the latest version of the main module when tagging
new releases (as the replace rule is non-transitional); something like:

1. update `github.com/containerd/imgcrypt` version in cmd/go.mod to "next release"
2. tag both `v<new release>` and `cmd/v<new version>` in tandem.

CI / validation also needs to be updated to verify both `go.mod` and `go.sum`
files are correct / up-to-date. Possibly checks should be added to make sure the
main module is isolated from the cmd module (i.e., the "module" should not import
any path from the cmd directory: the reverse is of course OK (and expected)).

Finally; use of the 'vendor' directory may need to be discussed; it is common
to only use a vendor directory for projects that produce binaries, but omit the
vendor directory for "library" projects. In this case (if vendoring is still
desired), the vendor directory should be removed from the root of the repository,
and moved inside the `cmd` directory.

Signed-off-by: Sebastiaan van Stijn <[email protected]>