clarify why TestScript sets GONOSUMDB (#958)

And unset it in gotoolchain.txtar, as that one testscript
does fetch modules from the real proxy.golang.org.

Closes #950.

main_test.go

@@ -90,7 +90,8 @@ func TestScript(t *testing.T) {
 			}
 			env.Setenv("HOST_GOMODCACHE", strings.TrimSpace(string(out)))
 
-			// We use our own proxy, so avoid sum.golang.org.
+			// We use our own GOPROXY above, so avoid using sum.golang.org,
+			// as we would fail to update any go.sum file in the testscripts.
 			env.Setenv("GONOSUMDB", "*")
 
 			// "go build" starts many short-lived Go processes,

testdata/script/gotoolchain.txtar

@@ -15,8 +15,11 @@ setup-go ${GOVERSION_BASE}
 
 # We want to use the real GOPROXY so that we can download the newer
 # toolchain, and we use the host's GOMODCACHE so we can reuse it.
+# Unset GONOSUMDB to get its default value, as TestScript's setup func
+# sets it to "*" to not use sum.golang.org with the testdata/mod modules.
 env GOPROXY=proxy.golang.org
 env GOMODCACHE=${HOST_GOMODCACHE}
+env GONOSUMDB=
 
 # Verify that we are using an older version of Go.
 exec go version