Update docs and scripts to force the use of vendor/

[isaacvr]

go 1.12+ uses the modules system by default unless you explicitly tell it to use the vendor folder. We use the vendor folder for security reasons and it should always be used.

Update docs and scripts to add GOFLAGS=-mod=vendor into the environment or pass -mod=vendor to go run invocations

See this issue for more info:
golang/go#27227