Consider vendoring dependencies

[vgough]

Eg using dep: https://github.com/golang/dep

I just tried to build gocryptfs, but get an incompatibility with go-fuse:

 ./build.bash 
# github.com/rfjakob/gocryptfs/internal/syscallcompat
internal/syscallcompat/getdents_linux.go:94:7: unknown field 'Ino' in struct literal of type fuse.DirEntry

The latest release of github.com/hanwen/go-fuse does not contain Ino, so this means we need a non-release version. Would be preferable, IMO, to have the dependencies vendored so that we can be sure of compatibility.

[rfjakob]

Good point. Reproducing a build is pretty hard right now. I have added the toml files and will integrate "dep" in build.bash once it is merged into the toolchain (should be Go 1.10?)

[rfjakob]

Fixed by:
(1) Adding Gopkg.lock and Gopkg.toml so users can run "dep ensure" on a git checkout
(2) Releasing a source tarball from v1.4.2 on that includes all dependencies . First tarball: https://github.com/rfjakob/gocryptfs/releases/tag/v1.4.2