Vendoring dependencies

As of https://github.com/cockroachdb/cockroach/pull/9900, we have a git submodule at /vendor that contains all our dependencies, meaning we should no longer be using or altering anything in GOPATH outside of cockroachdb/cockroach.

To add or change a dependency version, we’re currently using glide https://github.com/Masterminds/glide.
As documented in the vendor README, since vendor is an external repo, adding or changing a dep requires first pushing the revision to vendor to the vendored repo, then opening a PR in the main repo to bump the submodule ref and the glide.lock file.

Also note that for now we’re still installing tool binaries to GOAPTH/bin (e.g. go installing them from the vendored sources), but that too may be changed in the future to use a local .bin dir.

In case anyone else wants to clean up some of the detached HEAD checkouts left in their GOPATH (e.g. so go get -u's will work again), I used something like this (it will force checkout master in every repo in you GOPATH, so be careful if you have uncommitted work):

for d in `find $GOPATH/src -d -name .git | grep -v cockroach`; do echo $d; git -C `dirname $d` reset --hard master && git -C `dirname $d` checkout master; done