time to set up vendoring

[Dieterbe]

we should more tightly control which dependencies we build against.
case in point: i just spent a day QA'ing a release and forgot to build against the latest go-nsq library with my -30% allocation patch :( ), but also to prevent accidentally pulling in breaking changes.

we can even just pull in the actual code, so resist deps going offline. as long as go get doesn't pull those deps twice (once in vendor dir, once because it sees the import)

i've been looking at the glide tool for this, but there's a few different ones.

[Dieterbe]

i didn't like glide. govendor makes a lot more sense to me.

[Dieterbe]

@woodsaj I would like to just use govendor and store a copy of all dependencies in the vendor folder. this makes MT easily go-gettable as well. any objections?

[woodsaj]

No objection from me.