What's the problem that your tests depends on lib C, if it's using it it makes sense that the main program depends on it. Go test are part of the main program, if you want them separated then create another module that import a and c for testing.
This is a problem because every time C has a vulnerability, you get a deluge of vulnerability scanner alerts or Dependabot pull requests to update it, even though your application has nothing to do with C.
If anyone has a solution for this, I'd really love to hear it because it consumes a silly amount of time to deal with bogus vulnerability alerts.