They only need read permissions.

I do wonder whether #111 is failing due to the caching we might have (?)

Based on https://github.com/uber-go/zap/blob/master/.github/workflows/go.yml

* Update `tools`  versions

Trying to get #111 to run.

Not upgrading staticcheck above 0.3.3 because it requires Go1.19 which we cannot upgrade to yet (#111)

…114)

* Run tests on the latest 2 go versions, update go directive in go.mod

We support the latest two versions; we should be testing them.

Go directive shouldn't change much, I'm updating it to be in sync.
We're still pre Go 1.21, so this should not affect the users.

Need to update statichceck in the same PR:
- without it, it cannot recognize the new go version
- at the same time, staticcheck 0.3.3+ requires Go1.19

Fixes #105

Fixes #119
The solution is a copy from #120, but follows the testing framework
that we have - I did not want us to have a real `Sleep` in tests.

I'm not exactly thrilled by the testing setup (especially the
milliseconds) or the clock itself, but I'm not willing to totally give
up on it like #120 proposes.
I also wanted ALL implementations of the ratelimiter to be tested,
not just the currently selected.

Might follow up with some testing cleanups and/or clock migration.

Includes a prety serious slack bug, so IMO we should push a new
minor version.