convert dependency management to go modules

[BenTheElder]

• we're still using vendor/ for now, all of the scripts respect this except hack/{update,verify}-deps.sh
• we no longer need to vendor dep
• go 1.11+ is required to manage dependencies (but was already required for proper gofmt)

TODO:

• module proof how we interact with kubernetes (finding and building it)
• eliminate vendor and switch to a module cache proxy? 🤔
• update docs

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BenTheElder]

cc @neolit123
I was vendoring CRI to add mounts and not happy with how that was being pruned with dep so I kinda just went all in and bit the bullet on go modules.

[neolit123]

I was vendoring CRI to add mounts and not happy with how that was being pruned with dep so I kinda just went all in and bit the bullet on go modules.

+1
the sooner modules are adapted the better.
handling k/k will be interesting. i foresee hacks.

[BenTheElder]

/retest
note: working with go.mod requires go >= 1.11.4 (to avoid checksum mismatches, there are bugs in earlier go 1.11 versions)

[neolit123]

/lgtm
/hold

i guess i need to update to .4 too.

[BenTheElder]

/hold cancel