Release script fixes

[jmacd]

This adds a utility that can add and remove replace statements from a set of go.mod files.
This builds on previous developments in this repo -- continues relying on a go.work file being checked in.
The release tools will remove replace statements.
The genotelarrowcol tool will add replace statements.
This PR includes the results of

make prepare-release RELEASE_CANDIDATE=v0.8.0 PREVIOUS_VERSION=v0.7.0 MODSET=beta

which updates the go.mod files with an unreleased version, such that go work sync cannot succeed. It will succeed again after the release is pushed.

It was difficult to untangle several changes from happening at once.

1. The release v0.7.0 was improperly made, so the go tools want to update all .sum files with the actual sum of those tags.
2. The ocb tool at v0.88.0 would insert a necessary replace statement, so we needed v0.89.x

The change to v0.89.x was carried out using make genotalarrowcol which now runs go work sync, resulting in all modules receiving the update to v0.89.x. However, to avoid this sort of problem in the future, the ocb version is now hard-coded in the Dockerfile and Makefile.

[jmacd]

Note not using --skip-get-modules.
The GOWORK=off trick works too.

[lquerel]

@jmacd and @codeboten do we still need to apply #101 with this new PR?

[lquerel]

LGTM

[jmacd]

@lquerel this is an alternative to #101.
It would be nice, probably, to see this split into several incremental steps, but I found that it was near impossible to find a resting place between them.