cmd/vet: honor analyzer flags when running vet outside $GOROOT/src

Additional vet flags specified by user are discarded if 'go vet'
is invoked outside $GOROOT/src to check a package under $GOROOT
(including those under "vendor" of $GOROOT), fix it by avoiding the
overwriting, the logic of detemining if the package under vetting
comes from $GOROOT remains untouched.

Also checked 'go tool vet <options> <cfg>' and 'go vet <options>
<user pkg>', both worked w./w.o this fix.

Fixes #35837.

Change-Id: I549af7964e40440afd35f2d1971f77eee6f8de34
Reviewed-on: https://go-review.googlesource.com/c/go/+/209498
Run-TryBot: Jay Conrod <jayconrod@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Jay Conrod <jayconrod@google.com>

Author: Xiangdong Ji

src/cmd/go/internal/work/exec.go

@@ -1036,7 +1036,7 @@ func (b *Builder) vet(a *Action) error {
 		// There's too much unsafe.Pointer code
 		// that vet doesn't like in low-level packages
 		// like runtime, sync, and reflect.
-		vetFlags = []string{"-unsafeptr=false"}
+		vetFlags = append(vetFlags, string("-unsafeptr=false"))
 	}
 
 	// Note: We could decide that vet should compute export data for

src/cmd/go/testdata/script/vet_flags.txt

@@ -0,0 +1,8 @@
+env GO111MODULE=off
+
+# Issue 35837. Verify that "go vet -<analyzer> <std package>" works if 'pwd' is not $GOROOT/src
+# we utilize the package runtime/testdata/testprog as the issue is specific to vetting standard package
+
+go vet -n -unreachable=false runtime/testdata/testprog
+stderr '-unreachable=false'
+stderr '-unsafeptr=false'