Remove vendor dir and use go.mod directly

[snprajwal]

This issue is being opened to discuss the possibility of removing the vendor dir from the repo. Vendoring enables us to have reproducible builds, but at the cost of updates and security fixes in newer versions of the modules.

Including the upcoming crit library, we will be using three modules - proto, x/sys and protojson. All three are hardened packages with proper testing before every release. Go automatically fetches them when running go build based on the info in go.mod. We can use go get -u to update the deps manually when necessary.

[adrianreber]

Vendoring seems to be what many projects are doing and from my point of view it makes life easier because you have a working combination.

We can set up dependabot to ensure all dependencies are automatically updated.

[snprajwal]

Understood, will open a PR for dependabot soon 👍