sarama was causing some other indirect dependencies. Upgrading it fixes
the issue.

We now have 3 indirect dependencies listed in go.mod:

- github.com/go-logfmt/logfmt
- github.com/go-stack/stack
- gopkg.in/jcmturner/goidentity.v3

go-kit accounts for the first two and sarama for the last one. Since
sarama does support go modules, this may be something missing on their
side.