vendoring: isolate the vendor directory

Due to the new vendoring logic in the golang compiler it can cause
issues for projects that import a package that has vendored a package
that is used locally. See containers/image#223

This change moves the vendored sources to the package that uses them,
rather than for the whole project. Also is explictly is not vendoring
code repos from "github.com/opencontainers/". For now we'll consider
these non-remote. Though versioning may likely be future concern.

Fixes opencontainers#527
Obsoletes opencontainers#528

Signed-off-by: Vincent Batts <[email protected]>

Author: vbatts

glide.lock

@@ -0,0 +1,2 @@
+This imports `github.com/opencontainers/go-digest` and has intentionally not
+been vendored.

identity/vendor.md

@@ -1,4 +1,4 @@
-package: github.com/opencontainers/image-spec
+package: github.com/opencontainers/image-spec/schema
 import:
 - package: github.com/pkg/errors
   version: '>=0.7.0'
@@ -8,4 +8,3 @@ import:
   version: ~v1.4
 - package: github.com/shurcooL/sanitized_anchor_name
   version: 10ef21a441db47d8b13ebcc5fd2310f636973c77
-- package: github.com/opencontainers/go-digest