Vendoring source

[dunkelstern]

We can already override git urls to point to a local/vendor clone of a repository, but some people prefer git submodules or even checked in duplicates:

Proposal of a few new commands:

• vendor: records current commit id in lockfile and removes the .git directory in the checkout so git will recognize it as normal source
• submodule: remove package from external and re-add it as a git submodule (with possibly overridden url)
• dynamic: remove package from external and revert to normal git checkout