Evaluate vendor manage tools

[feiskyer]

We are using godep for managing vendors today, but it is not so easy to update standalone packages with godep. We should consider an alternative one. Some candidates include:

• vndr: containerd and moby are using it.
• glide: helm and kompose are using it.
• dep: dashboard is using it. But it's still not stable now, hoping to be the official toolchain in go 1.10.

I'd prefer vndr now, and we should switch to dep when it is stable.

[feiskyer]

/cc @resouer

[resouer]

Will do this first.