Add freeze and fetch -rebuild

[AngerM]

I figured these could be useful to others. It allows you to freeze versions and later repull exactly what you had if you check your vendor manifest into your repo without having to check in the source code for the projects in your manifest file.

[FiloSottile]

Hi! Thanks for your PR!

I'm not sure I understand the use case of the freeze command. Versions are always locked in the manifest (also with plain fetch), so if what you want is not committing the source why no just having a .gitignore in vendor/ ignoring everything but the manifest?

[AngerM]

Freeze prevents 'gvt update [-all]' from affecting the frozen requirements.

[AngerM]

Maybe I didn't answer both your questions. The reason for rebuild is for when you DO have vendor/* and !vendor/manifest in your gitignore. That way on a fresh pull of your workspace you can just do gvt fetch -rebuild and it will pull all requirements with the same versions you had at last commit.

[FiloSottile]

Sorry for the delay.

I like rebuild. I think I'd prefer having it as a top level command, what do you think? I can do that if you don't have time. I'll be happy to write the documentation. Also, would you mind if I contributed it back to gb-vendor?

I'm still not sold on freeze. I'm striving for gvt to be as simple as possible, go get for vendoring, and 1) it's still not clear to me what workflow it enables and 2) I'm not sure the manifest file is the right place for locks. (Also, I'd prefer the name lock. Freeze I expected to fetch stuff from my GOPATH Godep-style)

[AngerM]

Sounds reasonable. If I have time I will try and make rebuild a top level command and remove freeze for now.