go_1_16: init at 1.16

Changes are minor - I ended up just patching the ssl certs at the root
file, rather than trying to keep up with the various darwin changes.

The externalnetwork test helper location changed, to so I had to update
that patch as well.

- Add xcbuild as propagatedBuildInput on darwin 7e25bdba5e

pkgs/development/compilers/go/skip-external-network-tests-1.16.patch

@@ -0,0 +1,33 @@
+diff --git a/src/internal/testenv/testenv.go b/src/internal/testenv/testenv.go
+index c902b1404f..66016088a2 100644
+--- a/src/internal/testenv/testenv.go
++++ b/src/internal/testenv/testenv.go
+@@ -163,13 +163,15 @@ func MustHaveExecPath(t testing.TB, path string) {
+ // HasExternalNetwork reports whether the current system can use
+ // external (non-localhost) networks.
+ func HasExternalNetwork() bool {
+-	return !testing.Short() && runtime.GOOS != "js"
++	// Nix sandbox does not external network in sandbox
++	return false
+ }
+ 
+ // MustHaveExternalNetwork checks that the current system can use
+ // external (non-localhost) networks.
+ // If not, MustHaveExternalNetwork calls t.Skip with an explanation.
+ func MustHaveExternalNetwork(t testing.TB) {
++	t.Skipf("Nix sandbox does not have networking")
+ 	if runtime.GOOS == "js" {
+ 		t.Skipf("skipping test: no external network on %s", runtime.GOOS)
+ 	}
+diff --git a/src/net/dial_test.go b/src/net/dial_test.go
+index 57cf5554ad..d00be53b2c 100644
+--- a/src/net/dial_test.go
++++ b/src/net/dial_test.go
+@@ -990,6 +990,7 @@ func TestDialerControl(t *testing.T) {
+ // except that it won't skip testing on non-mobile builders.
+ func mustHaveExternalNetwork(t *testing.T) {
+ 	t.Helper()
++	t.Skipf("Nix sandbox does not have networking")
+ 	mobile := runtime.GOOS == "android" || runtime.GOOS == "ios"
+ 	if testenv.Builder() == "" || mobile {
+ 		testenv.MustHaveExternalNetwork(t)