Vendor dependencies for reliably reproducible builds

[neechbear]

As upstream dependencies change, it can be highly desirable to stash a local copy of those sources (vendor them). This is especially true if the upstream dependencies have a tendency to change more frequently than the project using them is maintained.