Need to consider `replace` in go.mod files

[atandrewlee]

I don't think we currently consider what is going on in replace when we build out our dependency tree.