We get a lot of false positive reports about data that we vendor in our repositories, and it would be nice to avoid many of those. Vendoring also makes our diffs needlessly large and there's no technical reason we need it in this project.

I'd like to propose that we stop vendoring and simply allow build processes to download as necessary as is standard with Go. Distros can still package dependencies to avoid needing network access during builds, and we can retain a vendoring target for people to prepare repositories for building if they'd like to do so.