Vendor dependencies

[jsha]

For the Trillian project (google/trillian#1220), I am trying to vendor all dependencies. Right now, Trillian depends on a specific version of protoc-gen-grpc-gateway. However, even if we pull that specific version, we don't currently have a good guarantee that we are getting a consistent set of dependencies pulled into protoc-gen-grpc-gateway. Would you consider vendoring this project's dependencies using dep? Vendoring represents the dependency management plan that the Go team is moving forwards with: https://blog.golang.org/versioning-proposal. Go's end goal won't be exactly like dep but will be similar, and the Go team has committed to a smooth transition.

[johanbrandhorst]

I'm personally in favor of just committing a Gopkg.toml and Gopkg.lock like opencensus-go did.

[tmc]

I think going the Gopkg route as a temporary measure makes sense. @johanbrandhorst can you take that on?

[johanbrandhorst]

@tmc I'm on it