This line:
requestToken := *oauth.RequestToken{Token:req.Oauth_token, Secret:""}
translated literally says “create an instance of oauth.RequestToken, then attempt to dereference it as a pointer.” i.e. it is attempting to perform an indirect (pointer) access via a literal struct value.
Instead, you want to create the instance and take its address (&), yielding a pointer-to-RequestToken, *oauth.RequestToken:
requestToken := &oauth.RequestToken{Token:req.Oauth_token, Secret:""}
Alternatively, you could create the token as a local value, then pass it by address to the TwitterApi function:
requestToken := oauth.RequestToken{Token:req.Oauth_token, Secret:""}
b, err := TwitterApi(&requestToken, req.Oauth_verifier)