[release-branch.go1.9] cmd/go: add options to security whitelist
    
    Also permit passing flags to pkg-config, as we used to.
    
    Also change the error message to refer to https://golang.org/s/invalidflag.
    
    Fixes #23749
    
    Change-Id: I3fbeb4c346610e6fd55e8720e720b0a40e352ab5
    Reviewed-on: https://go-review.googlesource.com/93836
    Run-TryBot: Ian Lance Taylor <iant@golang.org>
    TryBot-Result: Gobot Gobot <gobot@golang.org>
    Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
    Reviewed-on: https://go-review.googlesource.com/103135
    Run-TryBot: Andrew Bonventre <andybons@golang.org>
    Reviewed-by: Ian Lance Taylor <iant@golang.org>