refactor: move everything

* Don't vendor _test_ dependencies. Instead, drop them in their own module.
* Don't trust go's vendoring system. It doesn't allow vendoring multiple
versions (with go modules).
* Switch to go modules _with no dependencies_. And check that we never end up
with dependencies.

The nice part is that it's now a _lot_ harder to accidentally include unvendored
modules. (we were, in fact, doing this)

Author: Stebalien