Add a few lines about go mod in CONTRIBUTING.md

Shamelessly copied from https://github.com/prometheus/prometheus/blob/master/CONTRIBUTING.md#dependency-management

Signed-off-by: Sylvain Rabot <sylvain@abstraction.fr>

CONTRIBUTING.md

@@ -65,3 +65,25 @@ CI runs GCS and inmem tests only for now. Not having these variables will produc
 7. You may merge the Pull Request in once you have the sign-off of at least one developers with write access, or if you
    do not have permission to do that, you may request the second reviewer to merge it for you.
 8. If you feel like your PR waits too long for a review, feel free to ping [`#thanos-dev`](https://join.slack.com/t/improbable-eng/shared_invite/enQtMzQ1ODcyMzQ5MjM4LWY5ZWZmNGM2ODc5MmViNmQ3ZTA3ZTY3NzQwOTBlMTkzZmIxZTIxODk0OWU3YjZhNWVlNDU3MDlkZGViZjhkMjc) channel on our slack for review!
+
+## Dependency management
+
+The Prometheus project uses [Go modules](https://golang.org/cmd/go/#hdr-Modules__module_versions__and_more) to manage dependencies on external packages. This requires a working Go environment with version 1.11 or greater installed.
+
+To add or update a new dependency, use the `go get` command:
+
+```bash
+# Pick the latest tagged release.
+go get example.com/some/module/pkg
+
+# Pick a specific version.
+go get example.com/some/module/pkg@vX.Y.Z
+```
+
+Tidy up the `go.mod` and `go.sum` files:
+
+```bash
+GO111MODULE=on go mod tidy
+```
+
+You have to commit the changes to `go.mod` and `go.sum` before submitting the pull request.