Comment 2 for bug 1896246

For the record, the Ubuntu Security team signs off on the plan to vendor the golang dependencies for the google-guest-agent and google-oslogin-agent packages as they go through the MIR process, for the reasons given above.

Thanks!